⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A10 – Mishandling Exceptional Conditions

OWASP A10:2025 CWE-636 CWE-754 CWE-209

When code hits an unexpected condition, it has to decide what to do. Each tab is a different way to get that decision wrong — fail open, fall back insecurely, or leak secrets to the user.

CWE-636 Fail Open CWE-754 Silent Insecure Default CWE-209 Stack-Trace Leak
CWE-754 Improper Check for Unusual or Exceptional Conditions

A config loader silently falls back to insecure defaults when the file is missing or malformed. Operators never see the alert.

Vulnerable code: 
cfg = {'require_mfa': False, 'tls_only': False, 'debug': True}  # insecure defaults
try:
    open(path) ... parse ...
except Exception:
    pass   # silently keep defaults

Try it yourself

Load a missing file

Submit /nonexistent.cfg. Loader returns defaults.

See what you got

MFA off, TLS off, debug on — never logged.