Kyle opened Goat Gear Garage with a single 1972 Triumph Bonneville and a handshake loan. Twenty years later the inventory spans sixty bikes and the shop is still the same three bays. The website went live in 2019 and hasn't had a code review since.
Briarcliff Foundation has accepted humanities and historical-preservation proposals through the same Fluxx-style portal since 2018. The withdraw-application control was added late in development — and shares plumbing with the committee's own review tooling.
Salt Brook Pilates is a founder-led studio in the Hudson Valley running reformer classes out of two storefronts. The new profile endpoint went live without a strong-params review — the form only ever submitted four fields, so nobody worried about what else the API would accept.
Heartwood's site was built in a long weekend by a co-founder who reads more about fly-fishing than web security. The reset flow uses a 4-digit numeric code; the verify endpoint has no rate-limit, no captcha, and no lockout — so the 10,000-code space is fully enumerable.
Coined's treasury holds nine figures in crypto, and its cold-storage Vault guards the recovery phrase behind every coin of it. Your objective is simple to state: reach the account that controls the treasury and read the Vault's recovery phrase.
The whole team runs on Noted: standups, 1:1s, customer calls, all captured and summarised. Past the notes and the settings there's an internal admin area the staff use to run the workspace. Your objective is to reach it.
Temple Trust runs its order desk behind 'The Temple' — a freshly hardened portal bolted onto a v1 API nobody ever dared retire, watched over by 'developerDave', who's leaving and means to do damage on the way out. You're handed bob/temple123 to get through the front gate.
Pinegrass has been a member-funded library co-op since 1962. The portal was set up by Cyrus, the volunteer IT person, who picked a 'temporary' password for every staff account. None of them changed it. The login form, separately, is clearer about errors than is good for it.
TopHat & Co. has blocked hats on Marlowe Lane since 1887, and finally put the shop online last spring. A junior dev wired up the checkout over a weekend, cutting corners to make the launch date — and meant to come back and harden it once things settled down. They never did.
Autovation lets teams automate the boring parts: workspaces share automations by exporting workflows to a portable file. The importer rebuilds the workflow object straight from the upload, nodes and all. Rebuilding a saved object from an uploaded file is where things get interesting.
Quotin is a two-person letterpress studio in rural Vermont. The homepage offers any visitor a free preview proof: upload a monogram, get back a watermarked preview. Iris built it on a quiet Sunday — except for one shell call she didn't think too hard about.
Trellis is a two-person micro-SaaS run out of Lisbon. Five dollars a user, boards and threads and weekly digests. Marin built the signup endpoint on the same Sunday they shipped the marketing site. The frontend form sends three fields. The backend… is more accommodating.