TryBugHunt

The Leaky Audit Serializer

Easypython

PII Redaction Mutating In-Memory User Entity Credentials

0:00
Step 1: Test Traffic & Expose Flaw
"""
User Entity Model
Stores customer profile and active API credentials.
"""

class UserAccount:
    def __init__(self, user_id, api_secret, role="member"):
        self.user_id = user_id
        self.attributes = {
            "user_id": user_id,
            "api_secret": api_secret,
            "role": role,
            "is_active": True,
        }

    def authenticate(self, supplied_secret):
        return self.attributes.get("api_secret") == supplied_secret
Step 1: Test Traffic & Expose FlawClient-side WASM

Run a scenario below to trace audit logging. Prove that logging an audit event redacts and wipes the user's live in-memory api_secret.

Choose Traffic Scenario to TestClick to simulate
Architectural Guide & Interview Notes

Deep Dive: The Leaky Audit Serializer

An engineering analysis of why this AI-generated Pull Request passed isolated unit tests, how multi-tenant traffic exposes the architectural flaw, and how interviewers score your response.

The Root Cause Anti-Pattern

In Python, assigning a dictionary reference (raw_data = user.attributes) creates an alias to the live object in memory. Mutating sensitive fields in-place during serialization overwrites real customer credentials like api_secret with [REDACTED], breaking all subsequent authentication.

The Interviewer's Scoring Rubric

Candidates are assessed on whether they jump to trial-and-error editing or follow a hypothesis-driven approach. A "Strong Hire" candidate restates the data flow between modules, explains why single-client unit tests passed, crafts an adversarial probe showing cross-tenant leakage, and implements a surgical 1-line patch without breaking existing contracts.

Candidate Strategy for the Code Comprehension Round

  1. 1Map Module ContractsTrace how the gateway invokes the underlying service. Note what data is passed by reference vs. by value.
  2. 2Break It With An Adversarial ProbeSimulate concurrent or sequential traffic across multiple identities to force shared state mutation.
  3. 3Deliver a Surgical PatchMake the minimal required diff to ensure proper per-client state isolation without refactoring unnecessary files.
← Back to Code Comprehension Directory
Next scenario:The Scrambled Stream Pipeline (javascript)