the brief
THE TICKET STACK
“A customer saw something that wasn’t theirs.” Object-level authorization and payload exposure, hunted together. All of it is planted in TapTrust Federal (TapTrust Federal Credit Union) — 3 defects across 2 bug types, graded as one session.
THE TICKETS
— “I changed the id in the request and got somebody else’s record back.”
Where to work: Account reads with ids that are not yours; The teller approval queue, called without teller standing
— “Open devtools — the response is carrying fields customers were never meant to see.”
Where to work: The client-facing account payload, read raw
YOUR JOB
Work the app end to end. File a report for every defect you can pin down — what you saw, what you expected, exact steps.
Hard·banking·bring patience
what we grade
Coverage
Each bug found, weighted by severity
Severity class.
Correct triage of each bug
Reproduction quality
Clear, ordered, reproducible steps
Evidence
Environment, test data, proof
file a report
Nothing filed yet — open the composer and write it down before it gets away.
playing as guest —
sign in to save this run & your time