Attack / Observe / Patch / Rerun
Break it. Then fix it.
Try a cross-tenant read, a privilege escalation attempt, or a duplicate write. Observe the broken response, apply the server-side fix, then rerun the exact same synthetic request.
Synthetic API / CWE-639
Cross-tenant invoice read
A logged-in user can retrieve any invoice by changing the object ID.
Trust boundary: Authenticated principal → tenant-scoped data access
Server-side fix: Resolve the invoice under the authenticated tenant, and return 404 without revealing another tenant's data.
Select Run attack to observe the vulnerable handler, then apply the patch and rerun the same request.
Limits: This is deterministic, local-only teaching code. It does not send API requests, handle real users or money, prove database transaction safety, or implement production auth. A real fix also requires atomic stores, request-body binding, authorization policy tests and operational logging.
Reproduce the result locally
Download the exact model, test suite and threat model used here. Extract the archive and run the tests with Node.js 22+; no API key or external service needed.
Download source, tests & threat model