Trace every decision
See parsed input, branch choices, constrained execution, and output in one place.
A safe web security workshop
Break the pattern.
Then build it right.
Eight executable labs take you from vulnerable behavior through a tempting patch, its bypass, and a durable fix—all against disposable synthetic targets.
POST /lesson/sql-injection account = ' OR 1=1-- query → structure changed rows → 3 synthetic records result → exploit reproduced next → test the naive patch
8focused modules
4phases per lesson
0real targets
Read the exact code
Marker-bounded source and side-by-side patches connect behavior to implementation.
Practice the bypass
Learn why blacklist fixes fail before verifying a robust defensive pattern.