WebVerse
Coined's treasury holds nine figures in crypto, and its cold-storage Vault guards the recovery phrase behind every coin of it. Your objective is simple to state: reach the account that controls the treasury and read the Vault's recovery phrase.
WebVerse
The whole team runs on Noted: standups, 1:1s, customer calls, all captured and summarised. Past the notes and the settings there's an internal admin area the staff use to run the workspace. Your objective is to reach it.
WebVerse
TopHat & Co. has blocked hats on Marlowe Lane since 1887, and finally put the shop online last spring. A junior dev wired up the checkout over a weekend, cutting corners to make the launch date — and meant to come back and harden it once things settled down. They never did.
WebVerse
Autovation lets teams automate the boring parts: workspaces share automations by exporting workflows to a portable file. The importer rebuilds the workflow object straight from the upload, nodes and all. Rebuilding a saved object from an uploaded file is where things get interesting.
WebVerse
Twilight Confectionery's third-gen owner Aurora wrote the staff portal herself "with a little help from an old book of spells." The book did not cover parameterised queries, file-upload validation, or path traversal — and the portal has been left to its own quiet, glittering devices ever since.
WebVerse
Slate Quarry Books has been the antiquarian shop on the green since 1971. The proprietor's nephew built a small website; the catalogue is public, but the shop's consignment ledger — who left what on consignment, what each consignor agreed to as a floor — was never meant to be.
WebVerse
Evergreen Property Management's tenant portal — wired up by a contractor in 2018 — has stayed on its first auth implementation for six years. The legacy verifier still has the vendor-debug branch the contractor left in.
WebVerse
Margaret Holloway's tax firm portal accepts OFX/XML uploads for bank-statement reconciliation. Greta wrote the importer one snowed-in February in 2014 — the libxml flag pair came from a PHP manual page she had bookmarked at the time.
WebVerse
Maggie has shown Mapleton homes for thirty years. Her son Eli rebuilt the office website one weekend after PHP 5 came out — they've been swapping photos and prices on it ever since, but nobody's looked at the templating since the original Bush administration.
WebVerse
Snickerdoodle Bake-off's Bakers' panel hides the monthly mystery code in a note that almost nobody reads — but the admin login next door has more to say than its developers intended.
WebVerse
Apex Fitness rebuilt their member portal last year. The new build moved everything onto UUIDs — no more sequential IDs, no more spreadsheet leaks. Their CTO told the board it was "post-IDOR by construction." The CTO was, technically, describing one part of the system.
WebVerse
SunnySide Daycare's personalised confirmation page was built by a parent volunteer who picked the shortest Stack Overflow answer for rendering names. That answer used a template engine.