Checkpoint: Security Audit

This checkpoint grades security judgment in runnable form: classify vulnerable code, map defenses to threats, and encode/validate correctly — the same calls you'll make reviewing real pull requests.

Think like a defender

Security knowledge only becomes skill when you can say where the boundary is and what enforces it. The checkpoint's scenarios — the echoed input, the string-built query, the client-side-only authorization check — are the four or five mistakes behind most real breaches. Name them, fix them, and explain the fix in one sentence; that sentence is what a reviewer actually reads.

The defender's one-liner

For each scenario, the deliverable is a single sentence: "the risk is X, the boundary that stops it is Y." Say it about the reflected input (XSS, stopped by output encoding plus CSP), the string-built query (injection, stopped by parameterized statements), the client-only permission check (broken access control, stopped by server-side authorization). If you can produce those sentences without notes, the module landed.