The solution to Secure Code Review Challenge #2: Professional is live!
Quick recap: the Secure Code Review Challenge is a free biweekly series of full, realistic applications with vulnerabilities based on real-world CVEs — you review, identify, and exploit them the way you would in a real security review, not just spot-the-bug pattern recognition.
This one’s a good reminder that clean code and a secure app aren’t the same thing. Auth 
Authorization CSRF Injection — every business-logic and source-to-sink check came back clean.
And it still wasn’t enough.
The vulnerability wasn’t in anything the team wrote. It was sitting in a dependency, three versions behind a patch, reachable through a completely ordinary feature (PDF résumé export).
Watch the full walkthrough: https://youtu.be/2j3dM9OiOT0
Read the write-up: the-secure-code-review-challenge/solutions/002-professional/SOLUTION.md at main · mohamed-osama-aboelkheir/the-secure-code-review-challenge · GitHub
Try Challenge #2 yourself first: the-secure-code-review-challenge/challenges/002-professional at main · mohamed-osama-aboelkheir/the-secure-code-review-challenge · GitHub
Two things before you dive in:
Challenge #3 is already live in the repo the-secure-code-review-challenge/challenges/003-dice at main · mohamed-osama-aboelkheir/the-secure-code-review-challenge · GitHub
Watch → Custom → Releases on the repo to get notified the moment new challenges/solutions drop, instead of checking back manually
If you work through it, I’d love to know: did you catch the dependency early, or only after everything else checked out clean?
https://youtu.be/2j3dM9OiOT0