@oscar-diaz · 0 Days Since

os

Player card

Oscar Díaz

@oscar-diaz · last push Nov 5

Fully typed

Rank

#4 of 6

Score

761/1000

Focus area

Most of your lost points come from SQL injection

Use parameterized queries; never build SQL with f-strings or string concatenation.

Score breakdown

Security508/700

Code craft253/300

Docs59/100

Readability94/100

Type hints100/100

Pushes

Confirmed vulnerabilities

SQL injectionCWE-891 time
IDORCWE-6391 time

Code smells

Missing docstrings2 times

Recent pushes

Open any push for the full review.

Invoice detail endpoint
-23
Check Warneddcfcc2d1 mediumNov 5
Adds GET /invoices/{invoice_id}. The handler authenticates the caller but never checks that the invoice belongs to them, so any customer can enumerate other customers' invoices by id (IDOR).
Validate invoice status filter
+94
Check Passedf06ef04Nov 1

4

With vulns

250%

Clean streak

0

Score history

Security and craft stack up to the total score.

Security (of 700)
Craft (of 300)

Adds an allow-list for the status filter.

Fix invoice search to use bound parameters

Check Passedb41b1fdOct 22

Replaces the interpolated SQL in search_invoices with bound parameters; the injection introduced on day 2 is closed.

Invoice search by customer email

Check Failed392a4851 highOct 20

Introduces GET /invoices/search, which forwards the customer and status query parameters into BillingService.search_invoices where they are interpolated into raw SQL. Any authenticated user can dump or modify the invoices table.

02Days Since/acme-fintech

Overview Pushes Data Play

Overview Pushes Data Play