TryBugHunt

The Leaky Tenant Config

Mediumpython

Shared Mutable Default Parameter Leaks Private Tenant Credentials

0:00
Step 1: Test Traffic & Expose Flaw
"""
Multi-Tenant Report Service
Prepares telemetry and audit reports for external customer endpoints.
"""

class ReportService:
    # AI Attempt: Fallback to default dictionary when caller passes no custom headers
    def __init__(self, tenant_id, headers={}):
        self.tenant_id = tenant_id
        self.headers = headers
        self.headers["Content-Type"] = "application/json"
        self.headers["X-Tenant-ID"] = tenant_id

    def set_custom_header(self, key, value):
        self.headers[key] = value

    def build_payload(self, report_name):
        return {
            "tenant": self.tenant_id,
            "report": report_name,
            "request_headers": dict(self.headers)
        }
Step 1: Test Traffic & Expose FlawClient-side WASM

Simulate multi-tenant webhook traffic below. Prove that Tenant B's report inherits private bearer tokens configured by Tenant A.

Choose Traffic Scenario to TestClick to simulate
Architectural Guide & Interview Notes

Deep Dive: The Leaky Tenant Config

An engineering analysis of why this AI-generated Pull Request passed isolated unit tests, how multi-tenant traffic exposes the architectural flaw, and how interviewers score your response.

The Root Cause Anti-Pattern

The Interviewer's Scoring Rubric

Candidates are assessed on whether they jump to trial-and-error editing or follow a hypothesis-driven approach. A "Strong Hire" candidate restates the data flow between modules, explains why single-client unit tests passed, crafts an adversarial probe showing cross-tenant leakage, and implements a surgical 1-line patch without breaking existing contracts.

Candidate Strategy for the Code Comprehension Round

  1. 1Map Module ContractsTrace how the gateway invokes the underlying service. Note what data is passed by reference vs. by value.
  2. 2Break It With An Adversarial ProbeSimulate concurrent or sequential traffic across multiple identities to force shared state mutation.
  3. 3Deliver a Surgical PatchMake the minimal required diff to ensure proper per-client state isolation without refactoring unnecessary files.
← Back to Code Comprehension Directory
Next scenario:The Phantom Zero (python)