Log inBook a Demo
AI Simulations
Skill Paths
AI Labs

AI Labs Library

Fix, build and secure real code with Claude Code at your side, in a private cloud workspace. Pick a lab to see what it asks of you and what it measures.

Practice a skill

Hands-on challenges — filter to what you want to work on.
96 labs
SecureJunior
25 min

Fix a landing page screen readers can't use

Audit a marketing landing page for accessibility issues. Fix screen-reader, keyboard, and color-contrast problems without breaking the design.
htmlcss
BuildSenior
35 min

Build a pipeline that hands state between agents

Build the sequential handoff chain behind every multi-step agent: run_pipeline(agents, state) runs an ordered list of agents, threading one evolving shared state through each so agent N sees what agents 0..N-1 wrote. It short-circuits when an agent sets state['done'], and isolates a failing agent (records the error, keeps going) instead of crashing the chain. The shipped version passes the same original dict to every agent (writes never propagate, agents clobber each other), ignores the done flag, and dies on the first raise. Grading injects deterministic mock agents that tag and record the state they saw — no real LLM, no gateway — so the checks are about correct control flow, not model quality.
python
BuildMid
35 min

Cap an agent's steps and retry flaky tools

Make a tool-using agent loop ROBUST: enforce a hard step budget (stop and return a structured partial result instead of looping forever), retry a tool that raises up to a limit, and when a tool keeps failing, feed the error back to the model as an observation instead of crashing. The shipped agent ignores the budget, crashes on the first tool error, and never retries. Grading injects a deterministic scripted model and counting tools — no real LLM, no network.
python
BuildSenior
50 min

Build a tool-using agent with Claude Code

Build a small autonomous agent that uses Claude Code with tools — file I/O, web fetch, shell — to complete a multi-step task end-to-end.
python
BuildMid
30 min

Make an agent call tools until it answers

Build the beating heart of an AI agent: the tool-use loop. Implement run_agent(task, model, tools, max_iters) that calls a model, dispatches the tool it asks for, feeds the result back into the conversation, and repeats until the model says it's done — without looping forever. The shipped version drops tool results, mishandles termination, and calls the wrong tool. Grading injects a scripted mock model and counting tools, so no gateway or API key is needed.
python
RefactorSenior
35 min

Serve v1 and v2 clients from one API

A v2 API refactor renamed fields and changed a status code, silently breaking every v1 client. Support both contracts — v1 clients keep working, v2 clients get the new shape — without dropping the v2 improvements.
python
BuildSenior
40 min

Fix a transfer that loses or invents money

A double-entry money-transfer module violates its core invariants: transfer() uses float (rounding drift), permits overdrafts and negative balances, loses money when an account is unknown, and isn't atomic on rejection. Rebuild it so every transfer conserves money (debit == credit), rejects overdrafts without mutating state, and uses exact Decimal arithmetic.
python
BuildJunior
30 min

Write base64 encode and decode from scratch

Implement RFC 4648 base64 encode/decode from scratch — no stdlib base64 module. The shipped version has padding and bit-grouping bugs; make it match the standard exactly and round-trip every byte.
python
DebugJunior
15 min

Fix a buggy bash script until tests pass

A simple bash script with bugs. Fix it, make tests pass.
bash
DebugJunior
20 min

Fix a search that returns the wrong index

find_first() and find_last() are supposed to return the leftmost / rightmost index of a target in a sorted list that may contain duplicates, or -1 if absent. The shipped versions have the classic boundary binary-search bugs — one spins forever on some inputs and returns any match instead of the first, the other is off-by-one and reports a bogus index for absent targets. Fix the binary search so every edge case is correct, in O(log n).
python
BuildMid
35 min

Patch a filter that forgets items you added

A BloomFilter(size_bits, num_hashes) is producing false negatives — items you added report as absent because add() and contains() compute different bit positions. Fix the hashing so there are zero false negatives and the false-positive rate stays low.
python
BuildSenior
45 min

Build a token-bucket limiter that returns 429

Implement a token-bucket rate limiter that passes a precise behavioral spec: allow a burst up to capacity, 429 after, refill over time, and stay exactly correct under concurrent load.
python
OptimizeSenior
40 min

Stop concurrent cache misses from hammering the backend

A read-through cache lets every concurrent miss for the same key hammer the expensive backend — a cache stampede. Add single-flight so concurrent misses for one key trigger exactly one backend call and the rest reuse the result, without breaking per-key correctness or cache hits.
python
BuildSenior
45 min

Cut off a failing dependency and probe recovery

Implement a circuit breaker that wraps a flaky dependency: trip OPEN after N consecutive failures, fast-fail without calling the dependency during the cooldown, then HALF_OPEN a single trial call that closes the circuit on success or re-opens it on failure. Time is driven by an injectable clock so behavior is exactly testable.
python
BuildMid
35 min

Flag claims no source actually supports

Catch RAG hallucinations before they ship: implement check(claims, sources) that decides, for each sentence an LLM produced, whether it is actually grounded in the retrieved sources — deterministically, by normalized text overlap. The shipped version does exact case-sensitive substring matching, so every paraphrase or re-cased supported claim is wrongly flagged, and its source attribution is off by one. No model, no network: claims and sources are plain strings, and grading is its own grounding oracle over hand-labeled fixtures.
python
BuildMid
30 min

Build a confusion matrix and per-class F1

Implement classification metrics from scratch — a confusion matrix plus per-class precision, recall, and F1, with macro and micro averages — using only the Python standard library (no numpy, no sklearn). The shipped version swaps precision and recall, crashes on a never-predicted class (division by zero), transposes the confusion matrix, and computes macro as a support-weighted average. Fix all four and handle the zero-division cases as 0.0.
python
BuildSenior
45 min

Fix a pool that leaks database connections

Implement a bounded connection pool that creates connections lazily, reuses released ones (factory called at most size times), raises PoolExhausted when all connections are checked out, and supports a context manager that auto-releases. The shipped version is buggy: it opens a fresh connection on every acquire, never reuses, never caps, and loses connections on release.
python
BuildSenior
45 min

Stop a hash ring from reshuffling every key

Implement HashRing(nodes, vnodes=...): get_node(key) maps a key to the first node clockwise on a hash ring built with virtual nodes (hashlib for stable positions, bisect for the lookup). Adding/removing a node must remap only ~1/N of keys, not all of them. The shipped version uses modulo hashing (a node change reshuffles everything) with no virtual nodes — fix it.
python
BuildSenior
40 min

Fit the highest-scoring passages into a token budget

The last mile of every RAG pipeline: you have retrieved chunks with relevance scores, and a hard token budget for the context window. Implement pack(chunks, budget) that selects the subset maximizing total relevance without exceeding the budget — an exact 0/1 knapsack — and returns the chosen chunks ordered by score descending, ties by id. The shipped version is greedy-by-score: it ignores each chunk's token cost, can blow the budget, includes a chunk too big to ever fit, and returns them in the wrong order. Grading computes the optimal selection with an independent DP oracle, so it is deterministic and non-gameable.
python
BuildMid
35 min

Fix a cron parser that misses scheduled runs

Implement next_run(expr, after) for standard 5-field cron (min hour dom month dow) supporting , lists, ranges, and steps. Return the next datetime strictly after after that matches. The shipped version has three bugs: an off-by-one on the minute, it silently ignores step values (/15 and 1-30/5), and it rolls the month over wrong (corrupting the year boundary).
python
SecureMid
30 min

Fix a CSRF check that accepts forged tokens

A form-posting web app defends against CSRF with a signed double-submit token, but the implementation is fake: the token just echoes the session id (no HMAC, fully predictable), it isn't bound to the session, verify accepts any non-empty string, and it compares with ==. Fix issue/verify so a token is HMAC-bound to its session, unpredictable, and checked in constant time.
python
SecureJunior
20 min

Stop a CSV export from injecting spreadsheet formulas

A reporting feature exports user-provided data to CSV by writing each cell verbatim, so a cell beginning with = + - @ (or TAB/CR) is executed as a formula when the file is opened in Excel or Google Sheets — a CSV/formula injection. Fix export_csv to neutralize dangerous leading characters (prefix with a single quote) without corrupting benign data, keeping the output valid CSV.
python
DebugJunior
20 min

Reconcile a bank ledger against a payments export

Finance has two CSVs that should match but don't -- a bank ledger and a payments export, with different date formats, messy money values, duplicate transaction IDs, and a few genuinely missing entries. Write a reconciler that normalizes both sides and emits an exact discrepancy report.
python
BuildMid
30 min

Fix a CSV importer that mistypes columns

A CSV import pipeline guesses each column's type from only the FIRST data row, so it mislabels mixed int/float columns as integer, ignores whether a column has empty cells, treats leading-zero codes like "01" as numbers, and crashes on an all-empty column. Rewrite infer_schema to decide each column's type and nullability from ALL rows, following an exact type-precedence contract.
python
BuildMid
30 min

Fix debounce and throttle that mistime event bursts

Reimplement the two utilities every frontend reaches for — debounce (trailing edge: collapse a burst into one call after quiet) and throttle (leading edge: at most one call per interval). Time is driven by an injected clock so the timing contract is exactly testable, no real timers.
python
BuildSenior
90 min

Software Engineer: Delete a user’s data everywhere, as GDPR requires

Use Claude Code to ship GDPR data export and account deletion in a gym-booking product whose member data is spread across many stores, while finance, the data protection officer and the SRE send rules live. Scored on test members the grader searches for in every table, file, log and restored backup; on your tests; on the proof you leave on the live data; and on how you worked with the agent.
pythonsqlite
DebugMid
25 min

Clear known CVEs from Node and Python dependencies

Audit and remediate known CVEs in a small Node + Python project. Plan upgrades, watch for breaking changes, document.
node
BuildSenior
45 min

Order a graph so dependencies come before dependents

Implement resolve_order(graph): a topological sort that orders nodes so every dependency comes before its dependent (including transitive deps and disconnected nodes), and raises CycleError on a cyclic graph. The shipped version loops forever / drops nodes — fix it.
python
BuildSenior
45 min

Fix a lock that lets two workers in

Implement a lease-based distributed lock: acquire grants a key if it's free OR its lease has expired, returning a unique fencing token and recording owner + expiry; release only succeeds for the matching token (a stale owner can't free someone else's lock); is_held respects TTL expiry. Time is read through an injected clock so behavior is exactly testable.
python
DebugMid
25 min

Make a compose stack reach Postgres and Redis

Three-service compose stack (web + Redis + Postgres). Web can't reach DB, Redis cache misses every time. Find the misconfigs.
docker
SecureSenior
45 min

Software Engineer: Ship a security-critical access change

Use Claude Code to ship an access-control change in an internal document service whose requirements were partly overruled in a chat thread. Scored on hidden cases, on your tests, on your written decisions, and on how you worked with the agent.
python
DebugJunior
30 min

Software Engineer: Find out why seats were sold twice

Use Claude Code to find out why a theatre ticketing service sold 23 seats twice: reproduce it from the night's event log, test the on-call note's theory, fix the real cause without leaving any paying customer empty-handed, make the call two colleagues disagree on, and prove the fix. Scored on unseen event logs, on your tests, on your recorded decision and numbers, and on how you worked with the agent.
python
BuildSenior
35 min

Score a model's answers into a pass rate

Build the eval loop every AI system needs: a run_eval(dataset, model, scorer) harness that runs a model over a dataset, scores each case, and reports a pass rate — without crashing when the model throws. The shipped version has buggy math, ignores the scorer, and dies on the first model error. Grading uses a deterministic mock model, so no gateway is needed.
python
BuildSenior
45 min

Evaluate arithmetic with correct precedence and parentheses

Implement evaluate(expr) for arithmetic with correct operator precedence, left-associativity, parentheses, unary minus, decimals, and defined errors. The shipped version evaluates strictly left-to-right (ignoring precedence) and mishandles parens and unary minus. Build a real parser — using eval/exec/ast.literal_eval is forbidden and detected.
python
BuildMid
30 min

Make a percentage rollout stable per user

Implement evaluate(flag, user): honor a master enabled switch, evaluate ordered targeting rules first-match-wins, and fall back to a STABLE percentage rollout (a hash bucket keyed on flag key + user id, so the same user always gets the same answer). The shipped version uses random(), gets rule precedence backwards, is off-by-one on the boundary, and ignores the master switch — fix it.
python
RefactorSenior
30 min

Make a prototype feedback board production-ready

A polished but prototype customer-feedback board (Kanban, drag-and-drop, persisted in localStorage) ships in the sandbox. Productionize it with Claude — add a test suite, migrate the UI to React + Vite, and make it mobile-friendly — previewing live through the Ports tunnel. Bonus: a 4-D AI-collaboration assessment of how you drove the migration.
javascriptreact
DebugMid
25 min

Fix a test that fails randomly in CI

A test suite passes locally but fails about a third of the time in CI. One test is flaky because of a real anti-pattern. Find why and make it deterministic -- without skipping it, weakening the assertion, or wrapping it in a retry.
python
BuildJunior
30 min

Fix signup validators that accept the wrong inputs

A signup form's backend validators pass the happy path but quietly accept (and reject) the wrong inputs in production: surrounding whitespace, None, unicode, boundary lengths, plus-addressed emails, international phones and leap-year dates. Harden every validator so it is edge-case-correct.
python
BuildSenior
45 min

Catch duplicate customer records that aren't exact matches

A customer-records deduper ships as exact-match only: it misses 'Jon Smith' vs 'jon smith', reverses the similarity threshold, and double-counts a record into two groups. Implement dedup(records, threshold): normalize (case, whitespace, punctuation, accents), compare with a documented similarity (normalized edit-distance ratio), single-linkage cluster the near-duplicates, and return groups where every record lands in exactly one group.
python
DebugMid
25 min

Patch a CI pipeline uploading broken artifacts

A CI pipeline silently uploads broken artifacts. Find the workflow bugs (caching, conditionals, secret usage).
yaml
BuildMid
40 min

Fix a glob matcher that flags wrong files

Implement a glob matcher — match(pattern, name) supporting *, ?, [abc]/[a-z]/[!abc] char classes, and ** (crosses /). The shipped version is buggy: greedy * crosses path separators, broken char classes, and ** is wrong. Fix it to pass a behavioral golden suite. No fnmatch/glob shortcuts.
python
OptimizeMid
65 min

Cloud Architect: Cut a doubled cloud bill without losing data

Use Claude Code to cut a doubled cloud bill on a simulated cloud driven from Terraform-style code, applying staging yourself after reading each plan, while the DBA, compliance and the CFO add constraints live. Scored on what the cloud recorded and who ran it, on plans for environments you have not seen, on your policy rule and its tests, on whether the numbers you hand over are true, and on how you worked with the agent.
python
BuildMid
30 min

Honor an Idempotency-Key so retries don't double-charge

A payment/order handler re-runs the charge on every retry — a duplicate request with the same Idempotency-Key charges the customer twice. Make handle() idempotent: execute the side effect once per key and replay the stored response on retries, while different keys still execute independently.
python
BuildMid
30 min

Stop a redelivered message from being handled twice

An at-least-once message queue redelivers. The shipped Consumer processes every redelivery — so the charge/email/side effect fires again on each duplicate, double-charging the customer. Make consume() process each message id EXACTLY ONCE: run the handler on the first delivery, store its result keyed by id, and replay the stored result on every redelivery — while a handler that RAISES leaves the id un-recorded so a later redelivery can retry it.
python
BuildMid
30 min

Make a JSON merge patch handle null correctly

Implement RFC 7386 JSON Merge Patch. The shipped merge_patch() gets the tricky parts wrong: it treats a null in the patch as set-to-null instead of deleting the key, deep-merges arrays instead of replacing them, and mutates the caller's input. Make it match the RFC exactly.
python
BuildMid
30 min

Fix a JSON Pointer that mangles escaped tokens

Implement RFC 6901 JSON Pointer resolution. The shipped resolve() mishandles the reference-token escapes (~1 -> / and ~0 -> ~, and the order matters), treats array indices as string keys so it never indexes into lists, and gets the empty pointer wrong. A missing key or out-of-range index must raise a defined ResolveError, not leak KeyError/IndexError. Make it match the RFC exactly.
python
SecureMid
35 min

Fix a login that never verifies JWT signatures

A login service trusts JWTs without actually verifying their signature — the classic auth bypass. Fix verify_jwt so it checks the HS256 signature in constant time, rejects alg:"none", and enforces expiry. Then attackers can no longer forge tokens.
python
RefactorMid
40 min

Refactor 200 lines of pricing without changing results

200 lines of tangled pricing logic with nested conditionals, magic numbers, and a copy-pasted discount branch — and zero tests. Refactor price_order() into clean, small, well-named code while keeping its behaviour byte-for-byte identical against 50+ golden cases.
python
BuildMid
35 min

Fix a cache that evicts recently used keys

An LRUCache(capacity) is silently evicting the wrong entries — it drops the oldest-inserted key (FIFO) instead of the least-recently-used one, and get() never refreshes recency. Fix the eviction to true LRU with O(1) get/put.
python
DebugSenior
35 min

Plug two memory leaks in an event bus

A long-running in-process EventBus powers a notifications worker. Two unbounded-growth bugs leak memory: unsubscribe() never removes listeners, and the delivery-dedup set grows forever. Find them and bound the growth without breaking delivery or dedup.
python
DebugJunior
25 min

Fix invoice totals that drift by a cent

A billing module computes invoice line totals, percentage tax, and a discount using float arithmetic -- so it's off by a cent on tiny prices, half-cent rounding, and long invoices. Fix it with decimal.Decimal (or integer cents) so every amount is penny-correct and round-half-up.
python
BuildMid
30 min

Route each subtask to the right agent

Build the dispatcher at the heart of every multi-agent system: an orchestrate(subtasks, agents) that routes each subtask to the specialist agent that owns its kind, calls it, and aggregates the results in input order. The shipped version routes by the wrong key, loses and reorders results, and crashes on an unknown kind. Grading injects deterministic mock specialist agents — no real LLM, no gateway — so the checks are about correct routing and aggregation, not model quality.
python
BuildMid
30 min

Put a multi-service stack behind nginx with TLS

Configure nginx as reverse proxy for a multi-service stack: TLS termination, websocket pass-through, smart caching, redirects.
nginx
DebugSenior
35 min

Reproduce and fix a race condition under load

Express + Postgres app with a subtle race condition that only fires under load. Reproduce, identify, fix.
nodejavascript
BuildJunior
30 min

Software Engineer: Add a discount without changing any other price

Use Claude Code to add a residents' discount to a 2016 ferry fare engine and its booking page without changing any other price by a cent, while two colleagues add requirements. Scored on unseen bookings, on your tests against broken engines, on a sign-off checked against your engine, and on how you worked with the agent.
javascriptnode
OptimizeMid
30 min

Kill the per-post queries in a /feed endpoint

A /feed endpoint loops over 500 posts and fires a separate query per post for the author and the comment count — the classic N+1. Batch it down to a constant number of queries while keeping the response byte-identical.
python
BuildMid
65 min

Software Engineer: Build the on-call handover tool

Use Claude Code to build a CLI that turns a night of production logs into the on-call handover, while your team sends new requests live. Scored on unseen data, on your tests, on what you leave in the repo for the next session, and on how you worked with the agent.
python
DebugMid
35 min

Harden a PHP login against OWASP top 10

Find and patch OWASP top 10 vulnerabilities in a real-looking PHP login system. SQL injection, XSS, weak auth, etc.
php
BuildMid
30 min

Fix pagination that skips records with tied timestamps

A /records list endpoint pages through an ordered dataset, but it uses a fragile OFFSET-style cursor that skips and duplicates rows at page boundaries whenever two records share a timestamp. Rebuild page() as proper keyset (cursor) pagination so a full walk yields every record exactly once, in order.
python
BuildSenior
35 min

Fan out to agents and merge what succeeded

Build the orchestration primitive every multi-agent system needs: fan_out(items, worker, reduce_fn, max_workers) runs a sub-agent over each item, gathers the results in input order, and reduces them — without one failing sub-agent sinking the whole batch. The shipped version aborts on the first exception, returns results out of order, and feeds the wrong shape into reduce. Grading injects deterministic mock workers (some raise on purpose), so there is no real LLM and the result is reproducible.
python
SecureMid
35 min

Replace unsalted password hashes with salted PBKDF2

A user store saves passwords insecurely (plaintext or a bare unsalted hash). Replace it with salted PBKDF2 hashing and constant-time verification, without breaking the hash/verify contract the app relies on.
python
SecureMid
25 min

Keep user paths from escaping the base directory

A file-serving helper joins a user-supplied path onto a base directory by naive string concatenation, so ../../etc/passwd, a leading /etc/passwd absolute override, and nested a/../../b all escape the sandbox. Its only 'defense' is a literal '../' substring check, and a sibling directory like /base-evil is mistaken for being inside /base. Rewrite safe_join to resolve the path purely (normpath) and reject anything that lands outside the base, raising PathTraversalError.
python
BuildSenior
90 min

Cloud Architect: Make the standby region take over, safely

Use Claude Code to make a payments app's standby region take over a regional outage safely, while the CTO, data, finance and compliance add constraints live. Scored on failure drills you have not seen, on your own drills against broken controllers and infrastructure, on your runbook run step by step, and on how you worked with the agent.
python
DebugMid
30 min

Find and fix an orders service throwing 500s

A live orders service started throwing 500s after a config change. Read the logs and metrics, find the root cause, patch it, and confirm the error rate drops to zero.
python
BuildMid
30 min

Write a prompt that extracts JSON from emails

Build a prompt that reliably extracts structured data from messy customer-support emails. JSON schema, error handling, evaluation.
prompting
SecureSenior
40 min

Stop retrieved text from hijacking an LLM prompt

Untrusted retrieved content (RAG chunks, tool output) is concatenated into an LLM prompt — a prime prompt-injection vector. Implement sanitize_context(text) to neutralize injected role markers, instruction-override phrases, and delimiter-breakout attempts while preserving legitimate prose. Graded deterministically against a held-out fixture policy — no model call.
python
BuildMid
35 min

Build a prompt renderer that resists template injection

Build a SAFE prompt templating engine: render(template, vars) substitutes {{name}} placeholders and honors {{#if key}}...{{/if}} and {{#each list}}...{{/each}} — while treating variable values as inert DATA, never template. A value containing {{...}} or an injection like 'SYSTEM: ignore previous instructions' must appear literally and never be re-interpreted. The shipped version re-renders substituted values (template injection), mishandles conditionals, and crashes on missing keys. Graded deterministically against a held-out fixture set — no model call.
python
BuildMid
25 min

Repair an ETL pipeline crashing on dirty data

Repair a broken ETL pipeline that crashes on real-world dirty data. Pandas + edge cases + defensive parsing.
pythonpandas
BuildMid
35 min

Parse and rebuild URL query strings by hand

Build the URL query-string codec every web framework needs: parse(qs) turns "q=hello%20world&tag=a&tag=b" into a dict and stringify(obj) turns it back — by hand, WITHOUT urllib.parse.parse_qs/urlencode. Handle percent + "+"/%20 decoding, repeated keys collapsing to a list, and empty values; make stringify a stable, encoded inverse. The shipped version doesn't decode, drops repeated keys, crashes on empty values, and doesn't encode — make it correct.
python
BuildJunior
30 min

DevOps Engineer: Stop planned maintenance from paging on-call

Use Claude Code to add maintenance silences to a logistics company's alerting service, which paged the on-call rotation 49 times on the night of an announced database maintenance, while the SRE lead and QA send a rule and a sign-off replay live. Scored on hidden replays of nights you have not seen, on your tests, on the decision you record, on replays you run yourself and on how you worked with the agent.
pythonsqlite
BuildMid
30 min

Chunk a document into overlapping retrieval passages

Implement the ingestion step of every RAG pipeline: a chunk(text, max_chars, overlap) that splits a document into overlapping, boundary-aware chunks. The shipped version is broken — it cuts mid-word at a fixed offset, ignores overlap so a fact on a seam is lost, and drops the tail (off-by-one). No model, no embeddings API: the text is plain data, and the grader locates each chunk back in the source to verify size, coverage, overlap and boundary invariants itself.
python
OptimizeSenior
45 min

Raise retrieval recall from 60% to 90%

Improve retrieval recall on a small product-docs corpus from 60% → 90%. Chunk strategy, embedding choice, query rewriting.
python
BuildSenior
40 min

Build a ReAct loop that reasons then acts

Build the core of an agent: the ReAct (Reason+Act) loop. run_react(task, model, tools) prompts a model, parses its 'Action: name[arg]' line, calls the matching tool, feeds the result back as an 'Observation:', and loops until the model emits a 'Final Answer:'. The shipped version has brittle parsing, never feeds observations back, and botches final-answer extraction so it never terminates. Grading injects a deterministic scripted model (no real LLM, no gateway) and checks the control flow + parsing, not model quality.
python
DebugMid
20 min

Fix a React counter that increments unpredictably

A counter component that should increment by 1 jumps unpredictably. Find the stale-closure bug, fix without rewriting from scratch.
reactjavascript
SecureJunior
35 min

DevOps Engineer: Make the release pipeline a real gate

Use Claude Code to turn a start-up's release pipeline into a real gate: find every way a broken or wrong build, or the deploy token, can still get out, close each one, prove it with pipeline tests, and decide how a flaky test is treated. Runs on a local CI runner. Scored on commits and events you have not seen, on your pipeline tests, on the CI's records as you leave them, and on how you worked with the agent.
pythonbash
BuildMid
30 min

Add backoff to a client that hammers upstream

An LLM/API client retries on every failure with no backoff and a wrong attempt count — it hammers a flaky upstream and retries errors that will never succeed. Fix retry() to do exponential backoff, give up after max_attempts, and only retry RetryableError (let everything else propagate immediately).
python
BuildJunior
25 min

Fix a converter that writes 4 as IIII

A Roman-numeral converter ships with broken subtractive notation: it writes 4 as IIII, 9 as VIIII, fumbles IX/XL/XC/CM, and round-trips fail. Fix int_to_roman() and roman_to_int() so both directions are correct and inverse across 1..3999, and so invalid input is rejected.
python
SecureJunior
20 min

Remove leaked secrets and add a pre-commit hook

Audit a small repo for leaked credentials, fix all findings, add a pre-commit hook to prevent recurrence.
git
SecureMid
30 min

Redact live credentials from exported support logs

A support-bundle exporter pastes raw logs into tickets — and those logs carry live credentials: AWS keys, bearer/JWT tokens, password=/api_key= values, long hex/base64 secrets, and card numbers. The shipped redact() misses most formats, mangles ordinary prose, and — worst — blanks the key while leaking the value after 'password='. Rewrite redact(text) so every secret is fully gone (not even a substring survives) while all non-secret text (words, code, emails) is preserved. Graded deterministically against a held-out golden log — no model call.
python
BuildMid
35 min

Fix a rate limiter that leaks across windows

Fix a rate limiter that leaks across window boundaries. The shipped version is a fixed-window counter — it admits up to 2×limit around the seam and never evicts old requests. Implement a true rolling window (evict entries older than now-window, count the rest) so the limit holds in EVERY window. Time is driven by an injectable clock so behavior is exactly testable.
python
OptimizeMid
30 min

Speed up a /report endpoint that rescans everything

A /report endpoint rolls up page views per session, but for a log of 600 events it runs nested linear scans — O(n^2) — and shows up as the hot path under a profiler. Rewrite it to O(n) using a single-pass dict and an O(1) set, keeping the report byte-identical.
python
SecureMid
25 min

Fix a login where user input becomes SQL

A login + user-search module builds SQL by concatenating user input straight into the query text, so 'alice' -- logs in with no password and ' OR '1'='1 dumps every user. Rewrite it to use parameterized queries against a real sqlite database without changing the legitimate behaviour.
pythonsqlite
OptimizeMid
25 min

Index and rewrite a 12-second reporting query

A reporting query takes 12 seconds in production. Use EXPLAIN ANALYZE, identify missing indexes, rewrite — get it under 500 ms.
sql
SecureSenior
35 min

Stop a URL fetcher from reaching internal addresses

An outbound 'fetch this URL for me' feature has a broken SSRF guard: it only string-blocks 'localhost' and '127.0.0.1', so the cloud metadata IP (169.254.169.254), private ranges, non-http schemes, and integer/hex/octal-encoded IPs all sail through. Rewrite is_safe_url to classify the host structurally with the ipaddress module — no DNS, no sockets — and block every SSRF class.
python
BuildMid
30 min

Summarize a log file bigger than RAM

A stats script must summarize an access log that is larger than the box has RAM. The naive version slurps the whole file and gets OOM-killed, and its p95 is computed from an unrepresentative sample. Rewrite it to stream the file in bounded memory and compute exact stats that match the golden output.
python
BuildMid
30 min

Extract valid JSON from messy LLM replies

LLMs return JSON wrapped in prose, fenced in ```json blocks, or with small syntax slips (trailing commas, single quotes). Implement extract_json(text) to robustly recover the intended JSON object from messy model output, raising a defined ParseError only when nothing is recoverable. Graded deterministically on held-out fixtures — no model call.
python
BuildSenior
120 min

Drone Common Operating Picture

Build a drone Common Operating Picture: live fleet map, TTL-bounded commanding for offline drones, and mission replay — against a provided fleet gateway simulator you may not modify. 2-hour timeboxed assessment.
reacttypescript
BuildMid
30 min

Trim a conversation to fit the context window

Fit a conversation into the context window: implement trim_to_budget(messages, budget, count_tokens) that always keeps the system message(s), then packs in as many most-recent messages as fit under the token budget, dropping oldest non-system first, never splitting a message, preserving original order, and raising BudgetError when system + the last message alone overflow. The shipped version drops the newest messages instead of the oldest, ignores the system message, and can exceed the budget. Grading injects a deterministic token counter, so no model or gateway is needed.
python
BuildMid
30 min

Validate and coerce an LLM's tool call arguments

The guardrail between an LLM's tool call and your code. Implement validate(args, schema) to validate AND coerce a model-produced args object against a small JSON-schema-like schema — models emit strings ('5', 'true', '3.14'), omit required fields, and invent enum values. Coerce the sane cases, raise a defined ValidationError (naming the field) on the rest. The shipped version does no coercion, no required check, ignores enum, and crashes on nesting. Graded deterministically on held-out fixtures — no model call.
python
BuildMid
35 min

Split a dataset reproducibly with balanced classes

Implement split(X, y, test_size, seed, stratify=True): a stratified, seeded train/test split that is reproducible, leaks no rows (train ∩ test = ∅, train ∪ test = all), sizes the test set to ~test_size, and preserves each class's proportion in both halves. The shipped version is unseeded, leaks/drops rows, ignores stratification, and hardcodes the size — fix it.
python
BuildMid
35 min

Fix an undo history that replays stale commands

Implement an UndoRedo(max_history) command-history manager — the engine behind editor undo/redo. do(command) applies a command and pushes it on the undo stack; undo() reverts the last command and moves it to the redo stack; redo() re-applies it. THE KEY RULE: a new do() after an undo() must CLEAR the redo stack (you can't redo a diverged branch). History is bounded by max_history (oldest dropped), and undo/redo at the boundaries are no-ops, not crashes. The shipped version is buggy: it never clears the redo stack on a new command (redo resurrects a stale branch and corrupts state), crashes when you undo past the start, keeps unbounded history, and redoes with no prior undo.
python
DebugJunior
25 min

Fix dedup that counts café as two users

A user-dedup / search-match helper treats canonically-equivalent unicode strings as different — 'café' typed with a combining accent fails to match the precomposed form, full-width characters miss, and non-ASCII case-folding (ß, İ) is wrong. It uses naive .lower() and ==. Fix it by normalizing (NFC) and case-folding before comparing — without ever matching genuinely different people.
python
BuildMid
35 min

Build a URL matcher with params and wildcards

Build the route matcher at the heart of a web framework: match(method, path, routes) resolving static segments, named params (/users/:id) and a rest-capturing wildcard (/files/*), with correct precedence (static > param > wildcard), method matching, and trailing-slash handling. The shipped version ignores the method, resolves by table order, and over-captures — make it correct.
python
BuildMid
30 min

Rank documents by cosine similarity for RAG retrieval

Implement the retrieval core of every RAG system: a search(query_vec, corpus, k) that returns the top-k corpus items by cosine similarity, highest first, ties broken by id. The shipped version is broken — it ranks on raw dot product (no normalization), so longer vectors win regardless of direction. No model, no embeddings API: vectors are plain data, and grading computes the cosine oracle itself.
python
BuildMid
30 min

Stop a virtual list clipping its last row

A fixed-row virtualized (infinite) list renders only the rows in view, but the shipped windowing math is wrong: it clips the last visible row (off-by-one on the exclusive end), ignores the overscan buffer, computes the wrong spacer offset, and never clamps — so it hands the consumer a negative start or an end past the array and blows up with an IndexError. Rebuild visible_window() so the rendered range is exactly right at the top, at the bottom, across a partial row at the viewport edge, and with overscan clamped at both ends.
python
SecureMid
30 min

Reject forged and replayed webhook requests

A webhook receiver's signature check is broken: it uses a naive == compare and never checks the timestamp, so it's vulnerable to timing attacks and replay. Fix verify_webhook to compute the HMAC over the signed payload, compare timing-safely, and reject stale (replayed) requests.
python
AI Simulations →Skill Paths →