An intentionally vulnerable Node.js / Express web application for practicing source-code security review. It contains ~20 deliberately planted vulnerabilities across authentication, access control, injection, and misconfiguration.
⚠️ Do not deploy this anywhere reachable. It is insecure by design. Run it only locally for training.
npm install
npm run seed # create + seed app.db
npm start # http://localhost:3000Seeded accounts:
| user | password | role |
|---|---|---|
| admin | admin | admin |
| alice | password1 | user |
| bob | hunter2 | user |
Read the source in routes/, views/, config.js, db.js, and server.js
and try to identify every security flaw before looking at the answer key.
The full list of planted issues (with file/line pointers and remediation) lives in
SOLUTIONS.md — try not to peek until you've done your own pass.
config.js hardcoded secrets / config
db.js, seed.js SQLite schema + seed data
server.js app wiring, session + error handling
routes/auth.js login, register, JWT, logout
routes/notes.js notes, search, guestbook
routes/files.js upload, download, ping, template view
routes/admin.js admin panel, user delete, transfer
routes/api.js fetch, preferences, calc, import, user dump
views/*.ejs templates (some render output unescaped)