For the judges
A small notes app. Try to break it.
This is the application Dongjo ships: a multi-user notes service with share links and search. It is deliberately small so you can check every claim yourself. The attacks below run from your browser against this production revision, with throwaway users created for you.
The app
What notes-api does
Users
POST /users with a username returns a bearer token, once. Only its SHA-256 is stored.
Notes
Create, list, read, edit, delete and search your own notes. Every note has exactly one owner.
Share links
Share a note with a link that expires within 24 hours. The owner can revoke every link of a note at once.
- Someone else's note returns
404, never403, so note ids cannot be probed. - No token or a wrong token returns
401, before anything else is read. - A revoked or expired link returns
404, like a link that never existed. - Search only ever returns your own notes, also from any cache.
Test cases
Try to break it
Each card is one attack from Dongjo's red team, rewritten to run in your browser. A pass means the app held. Each card links the attack test and the merge request or issue where Dongjo found or fixed the hole.
Do it your way
Or use curl
Everything on this page is plain HTTP. Users and notes you create live only in this revision's SQLite file and disappear with the next release.
| Endpoint | What it does |
|---|---|
| POST /users | create a user, returns its token once |
| POST /notes · GET /notes | create a note, list yours |
| GET · PATCH · DELETE /notes/{id} | read, edit, delete one of yours |
| GET /notes/search?q= | search your notes |
| POST · DELETE /notes/{id}/share | create a share link, revoke all of a note's links |
| GET /shared/{token} | read a shared note, no login |
| GET /version | the release and commit you are talking to |