DebugMidSecurityAuto-graded

Harden a PHP login against OWASP top 10

Shows whether unfamiliar code gets reviewed systematically, closing every hole rather than stopping at the first obvious one.You have been pulled onto a security review of a small login system before its first release — standard PHP, MySQL behind it, and a product manager who just needs to know it is safe. It is not. Sixty lines of login.php contain at least seven distinct vulnerabilities, covering most of the OWASP Top 10 in a single file. Find them all, patch each one, and briefly explain why each fix works.

35 min

php

Start lab

You're done when

Database queries use prepared statements rather than concatenated input.
User-supplied values are escaped on output, closing the cross-site scripting hole.
Passwords are stored with a strong hashing function rather than a fast digest.
The session identifier is regenerated on login, defeating session fixation.
Session cookies are marked HttpOnly and Secure.
The post-login redirect target is validated instead of being followed blindly.
Credentials and secrets are no longer hardcoded in the source.

What it measures

Security gap analysisFinding a full set of distinct vulnerabilities in one file rather than stopping at the first obvious one.

Code reviewReading unfamiliar code specifically for security properties, and articulating why each fix closes the hole.

Breadth across the Top 10Recognising injection, XSS, weak storage, session handling, open redirect and secret management as separate problems needing separate fixes.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo