Security for AI code

Validation that looks right and is not: redirects, paths, origins, escaping and parsing. Each exercise is a hole an assistant opened while doing exactly what it was asked.

2 exercises · ~13 min · 8 more coming soon

What you will practice

• Treat every allowlist and prefix check as suspicious until proven
• Recognize path traversal, open redirects and injection in harmless-looking helpers
• Write the hostile input that proves a check is broken

1. 1.

   The redirect check that trusts a leading slash

   Security · TS · 5 min

2. 2.

   The sanitizer that strips ../ exactly once

   Security · TS · 8 min