senior loop
Bug Hunt

Broken code. Fix it. 10

Production bugs with the artifacts you'd see on call — failing test, log excerpt, broken code. Identify the root cause, fix it, compare against the canonical solution.

10exercises
3free
5languages
AI-graded
Easiest free bug · start here

Order pagination returns duplicate rows

free

The /orders endpoint returns the same order on two consecutive pages. Find the off-by-one and fix it.

api·5 languages·12 min
Start debugging →

Ledger drift after refund retry

free
payments·5 languages·18 min

A refund retry occasionally produces a ledger entry where the refund is recorded twice but the wallet was credited once. Find the bug and fix it.

Start →

Click-tracking counter drops events under load

free
distributed·5 languages·22 min

Click-tracking endpoint occasionally undercounts events. Some events vanish, others crash the concurrent handler that increments. Find the bug and fix it.

Start →

Validation endpoint p99 climbs under load

pro
performance·5 languages·14 min

The /validate endpoint's p99 latency climbs from 8ms to 280ms once traffic crosses 500 RPS. Find the hot-path waste and fix it.

🔒Unlock →

Daily summary email arrives on the wrong day

pro
ops·5 languages·18 min

Users complain that their "yesterday's activity" email shows today's data, or skips a day entirely. Find the timezone bug.

🔒Unlock →

JWT verification accepts forged tokens

pro
security·5 languages·18 min

Security team filed a P1: an attacker can forge admin tokens against the auth middleware. Find the verification flaw and fix it.

🔒Unlock →

Worker pool leaks background workers on shutdown

pro
distributed·5 languages·20 min

A worker pool that processes background jobs leaks background workers on every service restart. Find what's wrong with the lifecycle.

🔒Unlock →

User profile endpoint accepts privilege escalation

pro
api·5 languages·20 min

PATCH /users/me lets a regular user upgrade themselves to admin by sending `{"role": "admin"}` in the body. Find the mass-assignment flaw and fix it.

🔒Unlock →

Background-task spans become orphans in tracing

pro
observability·5 languages·22 min

Distributed traces show order-creation as a clean parent span, but the email-send and audit-log operations dispatched after the order appear as detached root spans with no parent. Find the propagation bug.

🔒Unlock →

Idempotency cache returns the wrong customer's response

pro
payments·5 languages·24 min

Customer A submits a charge. Customer B submits a charge a few minutes later and gets back Customer A's payment confirmation. Find the cross-tenant leak in the idempotency layer.

🔒Unlock →