Syllabus
What the papers cover
79 original questions in eight sections. Every question is about code an assistant could hand you, and every answer links to the documentation, standard or reference it rests on: OWASP, MDN, the Python, PHP, npm, pip and Git documentation, NIST and others.
- A10 questions
Read the code
What the code an assistant wrote really does when it runs, not what its comment says.
Topics: slices and indexes, default sort order, async loops, default arguments, loose equality, values that look false, pattern anchors, AND/OR in SQL, reduce, swallowed errors.
- B9 questions
Secrets
Keys, passwords and tokens: where they leak, and what to do first when one does.
Topics: keys in the browser bundle, keys in git history, .gitignore, logs, where secrets live, debug pages, least-privilege keys, signing secrets, keys in URLs.
- C10 questions
Untrusted input
Anything a visitor, an upload or another site sends you, and how it turns into an attack.
Topics: SQL injection, cross-site scripting, shell commands, file paths, browser-only checks, server-side requests, uploads, redirects, raw HTML in React, unpickling.
- D10 questions
Accounts and access
Who may see and change what, checked on the server on every request.
Topics: object ownership, password storage, hidden admin buttons, cookie attributes, CSRF, reset links, sign-in messages, row-level security, mass assignment, attempt limits.
- E10 questions
Tests that prove it
Tests that can fail, fail for the right reason, and keep a fixed bug fixed.
Topics: tests of mocks, changed expectations, the clock, live services, coverage, snapshots, regression tests, shared state, expected exceptions, webhook signatures.
- F10 questions
Packages
The code you install: real names, pinned versions, install scripts and known holes.
Topics: invented package names, look-alike names, lockfiles, install scripts, audits, version ranges, abandoned libraries, hash checking, CDN scripts, security updates.
- G10 questions
Agents and prompts
Working safely with an assistant that can read, write and run things for you.
Topics: prompt injection, agent permissions, claims of success, secrets in prompts, model output in pages, system prompts, oversized diffs, invented APIs, sandboxes, instruction files.
- H10 questions
Edge cases
Money, time, text and timing: where correct-looking code quietly gives wrong answers.
Topics: floating-point money, rounding, daylight saving time, page offsets, races, string length, retries, empty input, month numbers, large ids.
How the questions are written
Each question has one best answer and three wrong ones, each with the reason it is wrong. The mark scheme explains all four. Option order is shuffled on every paper, so memorising letters does not help.
The questions were drafted by an AI assistant working for WeldonPC and checked against the source linked from each one. No AI runs on this site, and nothing you answer is sent to one. Sources change: the questions are re-checked against their sources from time to time, and one found out of date is corrected or removed. Until then, when a question and its source disagree, the source wins.