Quiz

# ============================================================
# Q1) Endpoint returns any user's profile by id. What is it?
# ============================================================
# ANSWER: A01 Broken Access Control.
# Fix: scope the query by the current user. current_user.profiles.find(id)
# instead of Profile.find(id).

# ============================================================
# Q2) Passwords stored as SHA-256 hex. Best move?
# ============================================================
# ANSWER: A02 Cryptographic Failures.
# Fix: migrate to argon2id (or bcrypt cost >= 12). Plan a rolling migration
# — verify against old hash on login, rehash with new algorithm in the
# success path, drop the old hash after N days of activity.

# ============================================================
# Q3) Search endpoint runs SELECT * FROM products WHERE name LIKE '%' || q || '%'.
# ============================================================
# ANSWER: A03 Injection.
# Fix: parameterise + escape LIKE wildcards. Add a tiny SQLi test to the route.

# ============================================================
# Q4) Money transfer endpoint with no rate limit + no idempotency.
# ============================================================
# ANSWER: A04 Insecure Design.
# Fix: rate limit (5 per minute per user), idempotency key, max-amount cap,
# observability on retry storms.

# ============================================================
# Q5) Production is running with APP_DEBUG=true. Worst case?
# ============================================================
# ANSWER: A05 Security Misconfiguration. Stack traces, env vars, and queries
# leak to anyone who triggers an error.
# Fix: ship a 'security baseline' file the CI compares against — fail the
# build if APP_DEBUG/DEBUG/development is detected on the prod build.

# ============================================================
# Q6) composer.json was last updated 14 months ago. What category?
# ============================================================
# ANSWER: A06 Vulnerable & Outdated Components.
# Fix: Dependabot/Renovate, weekly composer audit, fast emergency-patch path.

# ============================================================
# Q7) Login does not rotate the session after password change. Category?
# ============================================================
# ANSWER: A07 Identification & Authentication Failures.
# Fix: regenerate session id on every auth event, log out other devices when
# the user opts in, MFA on sensitive flows.

# ============================================================
# Q8) <script src='https://cdn.example/lib.js'> with no integrity attribute.
# ============================================================
# ANSWER: A08 Software & Data Integrity Failures.
# Fix: Subresource Integrity (sha384 hash + crossorigin='anonymous') OR
# self-host the library, OR use a CDN you control with Cache-Control headers.

# ============================================================
# Q9) No alert when one IP fails 200 logins in 60s. Category?
# ============================================================
# ANSWER: A09 Security Logging & Monitoring Failures.
# Fix: structured 'auth_failure' logs, alert on > 50/min/IP, store at least
# 90 days, link the alert to a runbook.

# ============================================================
# Q10) Image-preview endpoint fetches whatever URL the user posts. Category?
# ============================================================
# ANSWER: A10 Server-Side Request Forgery (SSRF).
# Fix: resolve the URL, block RFC1918 + 169.254 + link-local, allow only
# https on port 443, disable redirects (or re-validate after each), require
# IMDSv2 on AWS so SSRF cannot read instance creds.

# Scoring
# 10/10 -> shipping to PCI/SOC2 environments
# 7/10  -> bookmark the OWASP cheatsheet
# < 7   -> a focused half-day with the OWASP cheat sheet series

// 3 questions per lesson.