Expert Labs
Advanced AppSec and cloud cases: inspect evidence, fix a local implementation, verify tests, and write a reproducible report.
Four fictional cases with browser review and local Python exercises. Each report should include allowed and denied behavior, test results from your own implementation, and remaining risks.
- Tenant isolation under pressure — Review an invoice API where a valid session, a support role, and a client-supplied tenant create three different trust boundaries.
- Signed once, processed twice — Separate message integrity, freshness, and idempotency in a payment webhook. A valid signature is only one of the three checks.
- The signed artifact from the wrong build — Review a release gate that accepts any signed artifact. Bind trust to the expected repository, workflow, source ref, environment, and artifact digest.
- Cloud permissions with a tenant boundary — Reduce an over-broad object-store grant and prove the intended action, principal, bucket, and tenant prefix. Separate a small contract test from real IAM evaluation.