Scoreboard
0 / 9 challenges detected by the app itself at runtime. The rest are waiting for your scanners, reviewers, and agents.
| # | Challenge | Severity | CWE | Where | Status | Hint |
|---|---|---|---|---|---|---|
| 1 | Reflected XSS | High | CWE-79 | GET /search?q= |
open | The search page echoes your query back into the page as raw HTML. |
| 2 | Stored XSS | High | CWE-79 | POST /products/:id/reviews |
open | Product reviews are stored verbatim and re-rendered as raw HTML. |
| 3 | SQL Injection | Critical | CWE-89 | POST /login |
open | The login query is assembled with string concatenation. |
| 4 | SQL Injection (order tracking) | Critical | CWE-89 | GET /orders/track?email= |
open | The order-tracking lookup concatenates your email into the SQL query. |
| 5 | Broken Access Control (IDOR) | High | CWE-639 | GET /orders/:id |
open | Order pages never verify that the order belongs to the viewer. |
| 6 | JWT signed with a hardcoded secret | High | CWE-798 | src/config.js, src/routes/auth.js |
open | The session token carries the role claim and the signing key is committed to the repo. |
| 7 | Plaintext password storage | Medium | CWE-256 | src/db/seed.js |
open | Passwords are stored and compared as plain text. Read the users table and see for yourself. |
| 8 | Hardcoded admin credentials | Medium | CWE-798 | src/config.js |
open | The admin account ships with the application, credentials included. |
| 9 | Stack trace disclosure | Low | CWE-209 | src/server.js |
open | Force an unhandled error and the response hands you the full stack trace. |