Backend Bug Hunts: 216 Debugging Challenges

216 backend bug hunts — 56 easy · 109 medium · 51 hard — each a small project with a planted bug, a bug report and hidden tests that decide whether the fix…

Hunts: 216
By difficulty: 56 easy · 109 medium · 51 hard
Reward: 50 XP per complete fix

Bugs in services: request handlers, validators, rate limiters, caches, schedulers, parsers and the security checks between them — many modelled on incidents that made the news. The largest set of hunts, because it is where most production outages start.

Every backend bug hunt

Back to 1970 Easy · JavaScript · Dates · Underflow
Commission on the Tax Easy · JavaScript · Money · Validation
Distance to the Decimal Easy · JavaScript · Security · Privacy
Divide by Zero, Dead in the Water Easy · JavaScript · Error Handling · Validation
Divided by the Sum, Not the Average Easy · JavaScript · Money · Math
Every Region in One Flight Easy · JavaScript · Config · Deploys
Five Countries Missing From the Average Easy · Python · Data · Off By One
Four Hours of Any Password Easy · Python · Auth · Security
Gangnam Style Broke the Counter Easy · Java · Overflow · Counters
Good Time on the Enhancement Easy · Python · Validation · Time
Goto Fail, Goto Fail Easy · JavaScript · Security · Control Flow
Left-Pad the World Easy · JavaScript · Strings · Dependencies
Nine A.M. Somewhere Easy · Python · Timezones · Scheduling
Nobody Left to Fly Christmas Easy · Python · Validation · State
Posting on Anyone's Timeline Easy · JavaScript · Security · Auth
Pounds Where Kilograms Should Be Easy · Python · Units · Math
rm -rf on an Empty Variable Easy · JavaScript · Shell Safety · Empty Values
Secrets for Every Fork Easy · JavaScript · Security · Config
Sessions for Someone Else Easy · Java · Strings · Equality
The 1900 Leap Year Lie Easy · Python · Dates · Leap Years
The 37th of March Easy · Java · Validation · Dates
The Alarm That Slept In Easy · Python · Time · Modulo
The Auction That Closed Instantly Easy · Java · Time · Units
The Backup That Never Took Over Easy · JavaScript · Config · Retries
The Coupon That Stacked Itself Easy · Java · Idempotency · Pricing
The Deposits Nobody Reported Easy · Python · Validation · Money
The Dotless I in Istanbul Easy · Java · Unicode · Parsing
The Draft That Overwrote the Publish Easy · Python · Sync · Timestamps
The Error Code That Meant Yes Easy · JavaScript · Security · Error Handling
The Invite Link That Shared a Hash Easy · JavaScript · Security · Privacy
The Key That Joined the Wrong Repository Easy · JavaScript · Security · Validation
The Lookup That Confirmed Every Email Easy · JavaScript · Security · Privacy
The Meters That Thought It Was 1920 Easy · JavaScript · Time · Parsing
The Metric Mars Mission Easy · Python · Units · Conversion
The Mutable Default Trap Easy · Python · Python Gotchas · State
The Negative Invoice Easy · Python · Validation · Payments
The Negative-Price Flash Sale Easy · JavaScript · Pricing · Math
The Notification Echo Easy · Python · Dedupe · State
The Null Price Latte Easy · JavaScript · Null Safety · Pricing
The Password in the Debug Log Easy · JavaScript · Security · Logging
The Plague the Pets Carried Easy · JavaScript · State
The Preview That Minted Someone Else's Token Easy · JavaScript · Security · Auth
The Regex That Trusted Email Easy · JavaScript · Validation · Regex
The Request With Too Many Parameters Easy · Java · Security · Parsing
The Share Price That Outgrew Its Integer Easy · Java · Overflow · Money
The Slash That Flagged the Whole Web Easy · JavaScript · Data Validation · Substring Matching
The Spreadsheet That Ran Code Easy · JavaScript · Injection · CSV
The Unauthenticated Customer Lookup Easy · JavaScript · Security · Authentication
The Uploader Nobody Checksummed Easy · Python · Security · Validation
The Year 2038 Problem Easy · Java · Time · Overflow
The Year That Didn't Fit in an Int Easy · Java · Overflow · Time
Twelve Dollars for Google.com Easy · Python · Validation · Parsing
Two Digits Too Few Easy · Python · Parsing · Y2K
User Minus One Is Root Easy · Java · Security · Auth
Version 1.10 Beats Version 1.9 Easy · JavaScript · Versioning · Parsing
Your Password, in the Address Bar Easy · JavaScript · Security · Auth
610,000 Shares at One Yen Hard · JavaScript · Money · Validation
Ariane's Sixteen Bits Hard · Java · Overflow · Casting
Everyone Tried to Fix It at Once Hard · JavaScript · Feedback Loops · Caching
Ghost in the Hostname Buffer Hard · JavaScript · Security · Overflow
Heartbleed's Little Cousin Hard · JavaScript · Security · Bounds
Infinite Leverage Hard · Python · Finance · Validation
Priority Inversion on Mars Hard · Java · Concurrency · State
Rate Limiter Free-for-All Hard · JavaScript
Root, No Password, Second Try Hard · JavaScript · Security · Auth
Signed In as Somebody Else Hard · JavaScript · Concurrency · Auth
The /24 That Swallowed YouTube Hard · JavaScript · Networking · Security
The Alarm Queue That Went Quiet Hard · JavaScript · Concurrency · State
The Backslash at the End of the Line Hard · Python · Security · Overflow
The Block Only Half the Network Accepted Hard · Python · Consensus · Limits
The Break That Left the Switch Hard · Java · State · Networking
The Class Path Nobody Denied Hard · Java · Security · Validation
The Extra Second That Pegged Every CPU Hard · JavaScript · Time · Livelock
The Fetch That Reached the Metadata Service Hard · JavaScript · Security · SSRF
The Flag That Fired Old Code Hard · JavaScript · Feature Flags · Trading
The Freelist That Ate the Raft Log Hard · JavaScript · Performance · State
The Hang at 49.7 Days Hard · Java · Time · Overflow
The Heatmap That Mapped the Base Hard · JavaScript · Privacy · Aggregation
The Index That Started at Zero Hard · JavaScript · Money · State
The Intermediate Nobody Was Watching Hard · JavaScript · Security · Time
The Late Enactor and the Empty Record Hard · JavaScript · Concurrency · Networking
The Log That Looked Things Up Hard · Java · Injection · Logging
The Lookalike Domain Hard · Python · Security · Unicode
The Missing Torque Calibration Hard · Java · Config · Safety
The Opening Cross That Never Closed Hard · JavaScript · Concurrency · Convergence
The Password Reset Sent to a Second Address Hard · JavaScript · Security · Auth
The Re-Mirror Storm Hard · JavaScript · Retries · Backpressure
The Reject Term Moved to the Top Hard · JavaScript · Networking · Config
The Reply Meant for the Last User Hard · JavaScript · Concurrency · Caching
The Root That Brought Its Own Generator Hard · Java · Security · Validation
The Rover That Could Not Finish Booting Hard · JavaScript · Memory · Limits
The Scheduler That Never Converged Hard · JavaScript · Optimisation · Fallbacks
The Seventy-Two Byte Password Hard · JavaScript · Security · Auth
The Signature Made of Zeros Hard · Java · Security · Crypto
The Signature Nonce That Never Changed Hard · Python · Security · Randomness
The Task That Ran Out of Stack Hard · JavaScript · Recursion · Resource Limits
The Thruster That Spun It Faster Hard · Python · Config · State
The Track That Forgot Its Past Hard · Python · State · Safety
The Transaction That Changed Its Own Name Hard · JavaScript · Hashing · Idempotency
The Username That Changed When Asked Twice Hard · Python · Security · Unicode
The Wallet Library That Killed Itself Hard · JavaScript · Access Control · Initialization
The Zero Root Everyone Trusted Hard · JavaScript · Security · State
Three Runs Deep Is Not Deep Enough Hard · Java · Algorithms · Overflow
Twenty Thousand Spaces on the Home Page Hard · JavaScript · Performance · Regex
Two Spikes, 1.2 Seconds Apart Hard · JavaScript · Sensors · State
Two Waypoints, One Name Hard · Java · Parsing · Safety
Withdraw, Then Withdraw Again Hard · JavaScript · Security · Money
184 Billion Coins From Nowhere Medium · JavaScript · Overflow · Validation
248 Days to Reboot Medium · Java · Overflow · Counters
A Century of Missing Interest Medium · Java · Integer Division · Finance
alg: none Medium · Python · Security · JWT
Any Email You Asked For Medium · JavaScript · Security · Auth
Anyone Could Initialise the Wallet Medium · JavaScript · Security · Auth
Audio Before the Call Was Answered Medium · JavaScript · Security · State Machine
Crossing the Date Line Medium · JavaScript · Coordinates · Wraparound
Debts Averaged Out of Thin Air Medium · Python · Money · Validation
Default Country Roulette Medium · Python · Parsing · Phones
Document 000000001, No Login Required Medium · JavaScript · Security · Authorization
Entropy Removed to Silence a Warning Medium · JavaScript · Security · Randomness
Every 256th Setup Medium · Python · Overflow · State
Every Post, One Id at a Time Medium · JavaScript · Security · Rate Limiting
Ghost Rows in the Audit Log Medium · JavaScript
Half the Servers Had the Old Config Medium · JavaScript · Configuration · Consistency
Happy New Year, Dropped Messages Medium · JavaScript · Queues · Bounds
Interest Sent as Orders Medium · Java · Money · Validation
Locked Out of Everything Medium · Python · Networking · Validation
More Routes Than the Router Could Hold Medium · JavaScript · Resource Limits · Atomicity
Negative Altitude, Underground Medium · JavaScript · Sensors · Saturation
Nine Digits and You're In the Meeting Medium · JavaScript · Security · Access Control
Noon in Which Timezone? Medium · Python · Timezones · Parsing
One Customer's Config Took Down the Edge Medium · JavaScript · Configuration · Defensive Coding
One Domain Checked Three Times Medium · JavaScript · Security · Concurrency
One Flipped Bit, Gossiped Everywhere Medium · JavaScript · Networking · Consistency
One Sensor, No Second Opinion Medium · JavaScript · Redundancy · Sensor Fusion
One Typo, Half the Internet Medium · JavaScript · Validation · Operations
Orders Sent to the Unknown Queue Medium · Java · Validation · Routing
Random Routing, Idle Dynos Medium · Java · Networking · Concurrency
Retry After What? Medium · JavaScript · HTTP · Parsing
Rounded Out of a Refund Medium · Python · Rounding · Money
Scaled Down Overnight, Trampled at Dawn Medium · JavaScript · Autoscaling · Thundering Herd
Scaling Up Past the Thread Limit Medium · JavaScript · Capacity · Resource Limits
Schrödinger's Follower Count Medium · JavaScript · Consistency · Caching
Seven Minutes to Parse a Menu Medium · JavaScript · Performance · Complexity
Someone Else's Account Page, From Cache Medium · JavaScript · Caching · Security
Tenths of a Second Since 2000 Medium · Java · Overflow · Time
The API That Returned More Than the Profile Medium · JavaScript · Security · API Design
The App That Kept Registering Itself Medium · Java · Idempotency · State
The Blank Field That Crashed Every Region Medium · Java · Validation · Config
The Canary That Failed and Was Overruled Medium · JavaScript · Networking · Config
The Car That Only Asked for Its VIN Medium · JavaScript · Auth · Security
The Certificate Nobody Renewed Medium · Java · Time · Config
The Check That Hadn't Cleared Medium · JavaScript · Money · Validation
The Clock Started Eleven Hours Early Medium · Java · Time · State
The Console That Thought 2010 Was a Leap Year Medium · JavaScript · Dates · Leap Years
The Consumer Key That Opened Enterprise Mail Medium · Java · Security · Auth
The Defaults That Reached Every Object Medium · JavaScript · Security · Validation
The Deposit From Address Zero Medium · JavaScript · Security · Validation
The Distribution List That Replied to Itself Medium · JavaScript · Limits · Email
The Donation That Skipped the Health Check Medium · JavaScript · Money · Validation
The Drain Order That Matched Too Much Medium · JavaScript · Config · Networking
The Duplicate Check Skipped for Speed Medium · Python · Security · Validation
The Edge of the Far Lands Medium · Java · Overflow
The Email Claim Anyone Could Set Medium · JavaScript · Security · Auth
The Empty Argument List That Became Root Medium · Python · Security · Bounds
The Endpoint That Forgot Private Meant Private Medium · JavaScript · Security · Privacy
The Environment Variable That Ran Code Medium · JavaScript · Security · Parsing
The Exchange That Could Not List Itself Medium · JavaScript · Parsing · Validation
The Feature File That Doubled Overnight Medium · JavaScript · Config · Limits
The February 29th Certificate Medium · Java · Dates · Leap Years
The Fees That Priced People Out Medium · Python · Money · Validation
The Filter That Held Back the Flood Medium · JavaScript · Networking · Fail Closed
The Final Invitation That Never Came Medium · Python · Time · Validation
The Folder Called .GIT Medium · Python · Security · Validation
The Gene Named September 2nd Medium · Python · Coercion · Data Import
The Generator That Vanished Medium · Python · Iterators · Python Gotchas
The Greedy Regex Medium · JavaScript · Regex · Parsing
The Group Chat Nobody Approved Medium · JavaScript · Auth · Validation
The Hash That Started With a Zero Byte Medium · Python · Security · Crypto
The Index That Rounded Itself Poor Medium · Python · Floating Point · Rounding
The Installer That Deleted boot.ini Medium · Python · Security · Validation
The Internal Header Anyone Could Send Medium · JavaScript · Security · Auth
The Invariant Off by a Hundred Medium · Python · Money · Validation
The Key That Was Marked Keep Medium · JavaScript · Auth · Config
The Label That Kubernetes Removed Medium · JavaScript · Migration · Deprecation
The Leap Day Meltdown Medium · Python · Dates · Leap Years
The Leap Second That Went Negative Medium · JavaScript · Time · Networking
The Log That Wore Out the Car Medium · JavaScript · Resource Limits · Logging
The Midpoint That Overflowed Medium · Java · Overflow · Algorithms
The Missing Table Rows Medium · Python · Lookup Tables · Null Safety
The Node Update That Cut the Network Medium · JavaScript · Deployments · Draining
The One-Cent Book of Madness Medium · JavaScript · Pricing · Feedback Loops
The Open Redirect Medium · JavaScript · Security · URLs
The Path That Climbed Out Medium · Python · Security · Path Traversal
The Patriot's Drifting Clock Medium · Python · Floating Point · Time
The Payment Method Called Nothing Medium · JavaScript · Payments · Validation
The Percent That Escaped Medium · Java · Encoding · URLs
The Pointer That Ran Past the Buffer Medium · JavaScript · Memory Safety · Off-by-One
The Replayed Webhook Medium · Python · Security · Time
The Reset Mail Sent to a Look-Alike Medium · Python · Security · Unicode
The Route Leak Nobody Filtered Medium · JavaScript · Networking · Validation
The Storage Certificate That Lapsed Medium · Java · Time · Overflow
The Streak That Died at Midnight Medium · Python · Time · Timezones
The Term That Matched Every Route Medium · JavaScript · Networking · Config
The Tip That Didn't Add Up Medium · JavaScript · Rounding · Money
The Token That Never Dies Medium · JavaScript
The Update That Redirected Your Documents Away Medium · JavaScript · Migration · Data Loss
The Week Number That Went Back to 1999 Medium · Java · Time · Overflow
The Week That Belonged to Next Year Medium · Java · Time · Dates
The Wrong Audience Medium · JavaScript · Security · JWT
The Zune Freeze Medium · Java · Dates · Leap Years
Touchdown at Forty Metres Medium · JavaScript · Sensors · State Latching
Tweets From a Borrowed Number Medium · JavaScript · Security · Auth
Twenty-One Fields, Twenty Supplied Medium · JavaScript · Parsing · Bounds Checking
Two Files Named classes.dex Medium · Java · Security · Validation
Version 2.3.10 Is Not Older Than 2.3.9 Medium · JavaScript · Security · Versioning
Zero Usage Meant Zero Quota Medium · JavaScript · Quotas · Missing Data

Backend Bug Hunts: 216 Debugging Challenges

Every backend bug hunt

Browse by