⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A06 – Insecure Design

OWASP A06:2025 CWE-770 CWE-837 CWE-841

Insecure design = the architecture forgot a control. The code works; the specification is missing. Each tab shows a workflow where the missing rule lets abuse happen at scale.

CWE-770 No Throttling CWE-837 Single-Action CWE-841 Workflow Violation
CWE-770 Allocation of Resources Without Limits or Throttling

A password-reset endpoint with no rate limit. Spam it to enumerate accounts, bury inboxes, or burn through SMS budget.

Vulnerable code: 
SENT.append(token)
send_email(email, token)   # no per-email / per-IP / global rate limit

Try it yourself

Send a reset

Click once — normal behaviour.

Spam

Click 10+ times. Every one succeeds.

Tokens issued this session: 0