The Challenges
Short, sharp targets. One flag each. Every challenge teaches a single vulnerability class against a believable fictional app.
Self-Checkout
Cartwell Market's Scan and Go app locks your account behind a one-time code texted to your phone at sign in. Create an account, reach the verification step, and see whether that second factor really holds.
Billed
Billed is a small personal expense tracker. Anyone can sign up, but the account worth having belongs to the operator who reads the contact inbox. Get into the operations console.
Rexigon
A shop that sells collectible toy dinosaurs, grouped into five sets. The whole catalogue lives on one long page, so each set has a share-friendly deep link that jumps you straight to it once the page loads, all handled in your browser.
DirtOil
A flower-seed and garden-supply shop. It writes up its own growing guides and routes every guide click through a tidy handoff page that runs entirely in your browser.
Almanac
Almanac is a private journaling app, write dated entries, keep your photos, and carry the whole archive between devices. The catch is the "carry it across" part: exporting your capsule and importing it on another device are two halves of the same trusting handshake.
Cookbook
A recipe manager and meal planner. You can export any recipe to a portable backup and import it on another device, and the restore step trusts the backup a little too much.
Knockdown
A maker community for flat-pack furniture. Every build exports to one portable file you can share, and anyone can paste that file back in to restore the whole design, cut list, hardware, and the rendered preview, exactly as it shipped.
TicketSeason
A verified hockey-ticket marketplace that keeps you signed in between visits by stashing your account in a "remember me" cookie. The box office trusts whatever it finds in there.
DropCall
Wilderness Permits' search was rebuilt in 2023 with a deliberately minimal failure surface. Minimal is not the same as silent.