code:
@app.get('/orders/<oid>')
@login_required
def get_order(oid):
    o = db.get_order(oid)
    return o.to_json()

question: Which invariant does this route fail to enforce?

A. An order id must be a positive integer

B. A user may read only orders belonging to their own account

C. Orders must be returned as JSON

D. The route must require a login

answer: B


code: # get_doc enforces owner check; export_doc, email_doc, preview_doc each load the doc by id with NO owner check

question: What is the best root-cause statement?

A. There are three separate IDOR bugs to patch

B. Document authorization is not a shared invariant; each route re-implements (and some omit) the check

C. The export feature should be removed

D. The database is too slow

answer: B


code:
Bug A postcondition: attacker learns a valid internal report_id of another tenant.
Bug B precondition: a valid report_id.
Bug B: export endpoint checks login but not tenant ownership.

question: Edge A->B status? (A=proven B=probable C=speculative D=blocked)

A. proven

B. probable

C. speculative

D. blocked

answer: A


code:
Bug A postcondition: attacker learns an administrator's email address.
Bug B precondition: possession of a valid administrator session token.

question: Edge A->B (email leak -> admin auth) status? (A=proven B=probable C=speculative D=blocked)

A. proven

B. probable

C. speculative

D. blocked

answer: D


category: capability

code:
def update_avatar(req, user):
    user.avatar_url = req.json['avatar_url']
    db.save(user)
# elsewhere: worker does http_client.get(user.avatar_url)

question: What capability does controlling avatar_url most directly grant?

A. Knowledge of another user's ID

B. Ability to make the server issue a request to an attacker-chosen URL (SSRF primitive)

C. Execute arbitrary shell commands

D. Nothing; it only stores a string

answer: B


code:
@app.delete('/files/<fid>')
@login_required
def delete_file(fid):
    db.delete(db.get_file(fid))
    return {'ok':True}

question: What check is missing?

A. Authentication

B. Rate limiting

C. Object-level authorization (ownership/tenant of the selected file)

D. Input length validation

answer: C


category: confidence

code:
Claim: 'a normal user can read another tenant's invoice.'
Evidence: route lacks an ownership check in source; but repository scoping and middleware were NOT reviewed.

question: What confidence is warranted?

A. High - confirmed exploit

B. Medium - plausible but unverified prerequisites remain

C. None - no evidence at all

D. High - IDOR is always exploitable

answer: B


code:
def download_invoice(user, iid):
    if user.is_authenticated:
        return pdf(db.get_invoice(iid))

question: What does this code NOT check (that it should)?

A. Whether the user is authenticated

B. Whether the invoice belongs to the user's org / whether the user may view it

C. Whether the PDF renders

D. Whether the id is an integer

answer: B


code:
approve(p): p.status='approved'
edit(p,amt): p.amount=amt
execute(p): if p.status=='approved': provider.transfer(p.amount)

question: Which sequence breaks the invariant 'executed amount == approved amount'?

A. approve -> execute

B. edit -> approve -> execute

C. approve -> edit -> execute

D. approve -> approve -> execute

answer: C


code:
Bug A postcondition: attacker can upload an image file to their own gallery.
Bug B precondition: ability to write an EXECUTABLE file into a web-served directory.

question: Edge A->B status? (A=proven B=probable C=speculative D=blocked)

A. proven

B. probable

C. speculative

D. blocked

answer: D


code:
Bug A postcondition: attacker can set their own profile 'bio' field to arbitrary text.
Bug B precondition: ability to inject HTML that executes in an ADMIN's browser.
Context: the admin panel renders bios with automatic HTML-escaping.

question: Edge A->B status? (escaping is on)

A. proven

B. probable

C. speculative

D. blocked

answer: D


code:
Bug A postcondition: attacker learns a valid password-reset token for victim.
Bug B precondition: a valid, unconsumed reset token for the target account.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: A


code:
Bug A postcondition: attacker can cause the server to fetch an attacker-chosen URL (SSRF).
Bug B precondition: ability to reach the internal metadata service at 169.254.169.254.
Context: no network egress policy has been reviewed yet.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: C


code:
Bug A postcondition: attacker obtains a low-privilege API key scoped to read-only.
Bug B precondition: a key with write scope to modify billing.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: D


code:
Bug A postcondition: attacker can enumerate valid usernames via a login timing difference.
Bug B precondition: a list of valid usernames to target with credential stuffing.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: A


code:
Bug A postcondition: attacker controls the 'filename' field stored on an upload.
Bug B precondition: a path that escapes the upload directory when the download service joins it unsanitized.
Context: download service confirmed to do os.path.join(base, filename) with no canonicalization.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: A


code:
Bug A postcondition: attacker reads another tenant's document TITLE (metadata only).
Bug B precondition: the document's binary CONTENTS.

question: Edge A->B status?

A. proven

B. probable

C. speculative

D. blocked

answer: D


category: confidence

code:
Claim: 'the export route allows cross-tenant access.'
Evidence: route source lacks a tenant check AND the repository query was inspected and also has no tenant filter AND a lab request with a foreign id returned the object.

question: Confidence?

A. High - proven end to end by code + test

B. Medium

C. Low

D. None

answer: A


category: confidence

code:
Claim: 'this is remote code execution.'
Evidence: user input reaches a template render call; the templating engine's sandbox settings were NOT reviewed.

question: Confidence in RCE specifically?

A. High

B. Medium - SSTI primitive shown but sandbox/impact unverified

C. Low - no evidence

D. None

answer: B


category: confidence

code:
Claim: 'admin account takeover is possible.'
Evidence: only that an admin's email address was disclosed.

question: Confidence in account takeover?

A. High

B. Medium

C. Low - email alone does not establish authentication

D. Confirmed

answer: C