JavaScript Debugging Practice: 190 Bug Hunts on Real Code

190 JavaScript bug hunts — 53 easy · 97 medium · 40 hard — each a small project with a planted bug, a bug report and hidden tests that decide whether the…

Hunts: 190
By difficulty: 53 easy · 97 medium · 40 hard
Reward: 50 XP per complete fix

Small Node.js and browser projects with a planted bug: a cart total that goes negative once a coupon is applied, a session token that never expires, a rate limiter that limits nobody, a regex that trusts the wrong email, a price that rounds the tip away. Each hunt hands you the files, a bug report written the way support writes them, and hidden tests that pass only when the fix is complete.

Every JavaScript bug hunt

Average Watch Time: Infinity Easy · Frontend · Math · Division
Back to 1970 Easy · Backend · Dates · Underflow
Commission on the Tax Easy · Backend · Money · Validation
Distance to the Decimal Easy · Backend · Security · Privacy
Divide by Zero, Dead in the Water Easy · Backend · Error Handling · Validation
Divided by the Sum, Not the Average Easy · Backend · Money · Math
Double-Charged at Checkout Easy · Frontend · Idempotency · Payments
Every Region in One Flight Easy · Backend · Config · Deploys
Four Years and a Day Off Easy · Frontend · Dates · Configuration
Goto Fail, Goto Fail Easy · Backend · Security · Control Flow
IN () Means Nothing Easy · Database · SQL · Edge Cases
Infinite Scroll, Infinite Repeats Easy · Frontend · Pagination · Dedupe
Left-Pad the World Easy · Backend · Strings · Dependencies
Posting on Anyone's Timeline Easy · Backend · Security · Auth
Public by Default Easy · Frontend · Privacy · State
Refunds for Money Never Taken Easy · Database · Money · Validation
rm -rf on an Empty Variable Easy · Backend · Shell Safety · Empty Values
Secrets for Every Fork Easy · Backend · Security · Config
Ten Seconds to Next Episode Easy · Frontend · Timers · Off-by-one
The 130% Progress Bar Easy · Frontend · Math · Clamping
The 140-Character Lie Easy · Frontend · Strings · Unicode
The Backup That Never Took Over Easy · Backend · Config · Retries
The Cache Key With a Twist Easy · Database · Caching · Canonicalization
The Checkout Meltdown Easy · Frontend
The Dividend Paid in Ghost Shares Easy · Database · Money · Validation
The Error Code That Meant Yes Easy · Backend · Security · Error Handling
The ETA That Went Negative Easy · Frontend · Formatting · Math
The Infinite Spinner Easy · Frontend · State · Error Handling
The Invisible Tweet Button Easy · Frontend · Security · Config
The Invite Link That Shared a Hash Easy · Backend · Security · Privacy
The Key That Joined the Wrong Repository Easy · Backend · Security · Validation
The Lookup That Confirmed Every Email Easy · Backend · Security · Privacy
The Meters That Thought It Was 1920 Easy · Backend · Time · Parsing
The Move That Quartered Crits Easy · Frontend · Game Logic · Bitwise
The Negative-Price Flash Sale Easy · Backend · Pricing · Math
The Null Price Latte Easy · Backend · Null Safety · Pricing
The One-Night Overcharge Easy · Frontend · Dates · Off-by-one
The Password in the Debug Log Easy · Backend · Security · Logging
The Plague the Pets Carried Easy · Backend · State
The Preview That Minted Someone Else's Token Easy · Backend · Security · Auth
The Quote That Escaped the Link Easy · Frontend · Security · Parsing
The Regex That Trusted Email Easy · Backend · Validation · Regex
The Resurfaced Memory Easy · Frontend · Filtering · Privacy
The Slash That Flagged the Whole Web Easy · Backend · Data Validation · Substring Matching
The Spreadsheet That Ran Code Easy · Backend · Injection · CSV
The Sure Hit That Missed One Time in 256 Easy · Frontend · Randomness · Games
The Tweet ID JavaScript Rounded Off Easy · Frontend · Parsing · Identifiers
The Unauthenticated Customer Lookup Easy · Backend · Security · Authentication
The Upvote That Counted Twice Easy · Frontend · Dedupe · State
The Vanishing Search Results Easy · Frontend
Undo Send Never Works Easy · Frontend · Units · Timers
Version 1.10 Beats Version 1.9 Easy · Backend · Versioning · Parsing
Your Password, in the Address Bar Easy · Backend · Security · Auth
610,000 Shares at One Yen Hard · Backend · Money · Validation
Both Halves Thought They Were Primary Hard · Database · Consensus · Split Brain
Cache Stampede at Dawn Hard · Database
Drill or Live, Same Prompt Hard · Frontend · UX · Validation
Everyone Tried to Fix It at Once Hard · Backend · Feedback Loops · Caching
Ghost in the Hostname Buffer Hard · Backend · Security · Overflow
Heartbleed's Little Cousin Hard · Backend · Security · Bounds
Keyset Without a Tiebreak Hard · Database · Pagination · Ordering
One Shard Took Every New User Hard · Database · Sharding · Scaling
Rate Limiter Free-for-All Hard · Backend
Root, No Password, Second Try Hard · Backend · Security · Auth
Signed In as Somebody Else Hard · Backend · Concurrency · Auth
Six Degrees, Give or Take Hard · Frontend · Graphs · BFS
The /24 That Swallowed YouTube Hard · Backend · Networking · Security
The Alarm Queue That Went Quiet Hard · Backend · Concurrency · State
The Extra Second That Pegged Every CPU Hard · Backend · Time · Livelock
The Fetch That Reached the Metadata Service Hard · Backend · Security · SSRF
The Flag That Fired Old Code Hard · Backend · Feature Flags · Trading
The Freelist That Ate the Raft Log Hard · Backend · Performance · State
The Gift Card Paid Twice Hard · Database · Concurrency · Money
The Heatmap That Mapped the Base Hard · Backend · Privacy · Aggregation
The Index That Started at Zero Hard · Backend · Money · State
The Intermediate Nobody Was Watching Hard · Backend · Security · Time
The Late Enactor and the Empty Record Hard · Backend · Concurrency · Networking
The Opening Cross That Never Closed Hard · Backend · Concurrency · Convergence
The Password Reset Sent to a Second Address Hard · Backend · Security · Auth
The Player That Wore Out Disks Hard · Database · Caching · Limits
The Re-Mirror Storm Hard · Backend · Retries · Backpressure
The Reject Term Moved to the Top Hard · Backend · Networking · Config
The Reply Meant for the Last User Hard · Backend · Concurrency · Caching
The Rover That Could Not Finish Booting Hard · Backend · Memory · Limits
The Scheduler That Never Converged Hard · Backend · Optimisation · Fallbacks
The Seventy-Two Byte Password Hard · Backend · Security · Auth
The Task That Ran Out of Stack Hard · Backend · Recursion · Resource Limits
The Transaction That Changed Its Own Name Hard · Backend · Hashing · Idempotency
The Wallet Library That Killed Itself Hard · Backend · Access Control · Initialization
The Zero Root Everyone Trusted Hard · Backend · Security · State
Twenty Thousand Spaces on the Home Page Hard · Backend · Performance · Regex
Two Spikes, 1.2 Seconds Apart Hard · Backend · Sensors · State
Withdraw, Then Withdraw Again Hard · Backend · Security · Money
184 Billion Coins From Nowhere Medium · Backend · Overflow · Validation
Access Denied at Midnight Medium · Database
Any Email You Asked For Medium · Backend · Security · Auth
Anyone Could Initialise the Wallet Medium · Backend · Security · Auth
Audio Before the Call Was Answered Medium · Backend · Security · State Machine
Crossing the Date Line Medium · Backend · Coordinates · Wraparound
Cursor Chaos After the Emoji Medium · Frontend · Unicode · Strings
Document 000000001, No Login Required Medium · Backend · Security · Authorization
Entropy Removed to Silence a Warning Medium · Backend · Security · Randomness
Every Post, One Id at a Time Medium · Backend · Security · Rate Limiting
False Positives at the Signup Gate Medium · Frontend
Ghost Rows in the Audit Log Medium · Backend
Half the Servers Had the Old Config Medium · Backend · Configuration · Consistency
Happy New Year, Dropped Messages Medium · Backend · Queues · Bounds
Java, Newline, Script Medium · Frontend · Security · Parsing
Listening Everywhere, Asking Nothing Medium · Database · Security · Config
More Routes Than the Router Could Hold Medium · Backend · Resource Limits · Atomicity
Negative Altitude, Underground Medium · Backend · Sensors · Saturation
Nine Digits and You're In the Meeting Medium · Backend · Security · Access Control
One Customer's Config Took Down the Edge Medium · Backend · Configuration · Defensive Coding
One Domain Checked Three Times Medium · Backend · Security · Concurrency
One Flipped Bit, Gossiped Everywhere Medium · Backend · Networking · Consistency
One Plus Two Plus Three Is Twenty-Four Medium · Frontend · State · Rendering
One Sensor, No Second Opinion Medium · Backend · Redundancy · Sensor Fusion
One Typo, Half the Internet Medium · Backend · Validation · Operations
Readable Passwords at Rest Medium · Database · Security · Hashing
Release the Connection! Medium · Database · Connection Pool · Error Handling
Retry After What? Medium · Backend · HTTP · Parsing
Scaled Down Overnight, Trampled at Dawn Medium · Backend · Autoscaling · Thundering Herd
Scaling Up Past the Thread Limit Medium · Backend · Capacity · Resource Limits
Schrödinger's Follower Count Medium · Backend · Consistency · Caching
Seven Minutes to Parse a Menu Medium · Backend · Performance · Complexity
Shuffle Isn't Random Medium · Frontend · Algorithms · Randomness
Sold Out, Sold Again Medium · Database · Inventory · Check-Then-Act
Somebody Else's Videos in My Takeout Medium · Database · Concurrency · State
Someone Else's Account Page, From Cache Medium · Backend · Caching · Security
Someone Else's Bank Account Medium · Database · Migration · Identifiers
Stuck on Mute Medium · Frontend · State · Stale Closures
The API That Returned More Than the Profile Medium · Backend · Security · API Design
The Backup That Deleted the Primary Medium · Database · Replication · State
The Canary That Failed and Was Overruled Medium · Backend · Networking · Config
The Car That Only Asked for Its VIN Medium · Backend · Auth · Security
The Check That Hadn't Cleared Medium · Backend · Money · Validation
The Cleanup That Deleted the Customers Medium · Database · Data Loss · Identifiers
The Config Value That Crashed Every App Medium · Frontend · Config · Validation
The Console That Thought 2010 Was a Leap Year Medium · Backend · Dates · Leap Years
The Defaults That Reached Every Object Medium · Backend · Security · Validation
The Deposit From Address Zero Medium · Backend · Security · Validation
The Distribution List That Replied to Itself Medium · Backend · Limits · Email
The Donation That Skipped the Health Check Medium · Backend · Money · Validation
The Drain Order That Matched Too Much Medium · Backend · Config · Networking
The Email Claim Anyone Could Set Medium · Backend · Security · Auth
The Endpoint That Forgot Private Meant Private Medium · Backend · Security · Privacy
The Environment Variable That Ran Code Medium · Backend · Security · Parsing
The Exchange That Could Not List Itself Medium · Backend · Parsing · Validation
The Feature File That Doubled Overnight Medium · Backend · Config · Limits
The Fields You Never Saw Medium · Frontend · Security · Privacy
The Files Deleted Years Ago Came Back Medium · Database · Data · Sync
The Filter That Held Back the Flood Medium · Backend · Networking · Fail Closed
The Greedy Regex Medium · Backend · Regex · Parsing
The Group Chat Nobody Approved Medium · Backend · Auth · Validation
The Internal Header Anyone Could Send Medium · Backend · Security · Auth
The Key That Was Marked Keep Medium · Backend · Auth · Config
The Label That Kubernetes Removed Medium · Backend · Migration · Deprecation
The Leaning Tower of Pins Medium · Frontend · Layout · Algorithms
The Leap Second That Went Negative Medium · Backend · Time · Networking
The Log That Wore Out the Car Medium · Backend · Resource Limits · Logging
The Login Key Made of Passwords Medium · Database · Security · Auth
The N+1 Query Storm Medium · Database · ORM · Performance
The Node Update That Cut the Network Medium · Backend · Deployments · Draining
The One-Cent Book of Madness Medium · Backend · Pricing · Feedback Loops
The Open Redirect Medium · Backend · Security · URLs
The Payment Method Called Nothing Medium · Backend · Payments · Validation
The Payment Page Script Nobody Pinned Medium · Frontend · Security · Validation
The Phantom Unread Badge Medium · Frontend · State · Dedupe
The Phantom WHERE Clause Medium · Database
The Pointer That Ran Past the Buffer Medium · Backend · Memory Safety · Off-by-One
The Reducer That Bit the Hand Medium · Frontend · Immutability · State
The Rotation That Ate the Backups Medium · Database · Backups · Retention
The Route Leak Nobody Filtered Medium · Backend · Networking · Validation
The Script That Granted Everyone Everything Medium · Database · Permissions · Scoping
The Term That Matched Every Route Medium · Backend · Networking · Config
The Tip That Didn't Add Up Medium · Backend · Rounding · Money
The Toast That Never Left Medium · Frontend · Arrays · Mutation
The Token That Never Dies Medium · Backend
The Two-Terabyte Wall Medium · Database · Limits · Storage
The Update That Redirected Your Documents Away Medium · Backend · Migration · Data Loss
The Wrong Audience Medium · Backend · Security · JWT
Three Checkboxes and $900 Million Medium · Frontend · Forms · Defaults
Too Young by One Birthday Medium · Frontend · Validation · Dates
Touchdown at Forty Metres Medium · Backend · Sensors · State Latching
Tweets From a Borrowed Number Medium · Backend · Security · Auth
Twenty-One Fields, Twenty Supplied Medium · Backend · Parsing · Bounds Checking
Version 2.3.10 Is Not Older Than 2.3.9 Medium · Backend · Security · Versioning
When 65536 Read as Zero Medium · Frontend · Rendering · Overflow
Wildcards for Every Account Medium · Database · Security · Auth
Zero Usage Meant Zero Quota Medium · Backend · Quotas · Missing Data

JavaScript Debugging Practice: 190 Bug Hunts on Real Code

Every JavaScript bug hunt

Browse by