Codebase 1: Full-Stack Web + AI SaaS Audit

Audit a live AI Storefront (HTML/CSS/JS frontend + Node HTTP backend). Catch hardcoded secrets & /api/debug-env leaks, reflected XSS, SSRF preview risk, robots.txt/noindex SEO blocks, CLS shifts, N+1 loops, and uncached AI endpoints.

System Design Perspective

Web + AI Backend & FinOps Systems

Before You Start (Amazon AWS AI)

Run Codebase 1 (`node server.js`) and trace the unvalidated `/api/preview` SSRF hazard + uncached `/api/ai-summary` cost explosion.

Download & Run LocallyDownload .zip

Runtime: Node.js 18+ (Zero npm install required)

unzip buggy-ai-storefront.zip
cd buggy-ai-storefront
node server.js
# Then open http://localhost:3100 in Chrome/Edge and audit UI + server!

Bloomberg / Google / Meta AI-Assisted Multi-File Track

const CONFIG = {
  openaiApiKey: process.env.OPENAI_API_KEY || 'sk-live-HARDCODED-SECRET-987654',
  dbUrl: process.env.DATABASE_URL || 'postgres://admin:SuperSecretPass123@10.0.4.12:5432/store_prod',
};

if (pathname === '/api/debug-env') {
  res.end(JSON.stringify({ status: 'debug', env: CONFIG })); // LEAK!
}

if (pathname === '/api/preview') {
  const targetUrl = parsed.query.url || ''; // Unvalidated SSRF risk!
}

if (pathname === '/api/ai-summary') {
  uncachedAiRequestLog.push({ ts: Date.now(), prompt }); // Memory leak + zero rate limit/cache!
}