DEV Community: SecDim

OAuth Challenges now Available

Hamza — Tue, 07 Jul 2026 04:57:44 +0000

OAuth’s core purpose is secure delegation of access, but when apps blindly trust any valid token without verifying it, the trust model breaks down.

We built challenges that demonstrate how an adversary can use tokens from one service to impersonate users on completely unrelated platforms, effectively bypassing authentication and hijacking accounts.

The challenges are available in all popular languages:

C# Oauth
Java Oauth
Python OAuth
PHP Oauth
JS Oauth
TS OAuth
Ruby OAuth (Coming soon, check back often!)

Get a Prize for Challenge Submissions

Hamza — Thu, 02 Jul 2026 01:34:57 +0000

Less than a Month left until Submissions Close!

Build a challenge and submit it for the SecDim “Fix the Flag” competition at AppSec Village @ DEF CON 34

Winners get Prizes!

Check it out now

SecDim Gift Cards are now available!

Hamza — Wed, 01 Jul 2026 02:09:24 +0000

SecDim Gift Cards are now available for Pro subscriptions, so you can help a friend, colleague, student, or teammate level up their security skills with hands-on secure coding training.

A practical gift for developers who want to write safer code, sharpen their AppSec instincts, or learn secure vibe coding.

Give someone the Gift of Secure Coding

Ditch rigid, one-size-fits-all learning paths. Build your own.

Hamza — Thu, 25 Jun 2026 06:02:24 +0000

Traditional security training doesn't work for everyone. You either waste time revisiting concepts you already know, or jump into advanced topics before you're ready.

The new SecDim MCP changes that. Connect it to your AI assistant to build a secure coding and secure AI learning path tailored to your experience, goals, and available time.

Connect it to your AI assistant to:

Generate personalised learning paths aligned with your engineering goals.
Discover short courses and hands-on challenges relevant to your technology stack.
Explore secure coding content directly within your workflow.

Integrations instructions can be found here:

https://support.secdim.com/support/integrations/mcp-server

FIFA World Cup 2026 Broadcast Hack: API Vulnerability Exposed Live Stream Control

Hamza — Tue, 23 Jun 2026 02:40:43 +0000

During the FIFA World Cup 2026, a security researcher registered a standard account on FIFA's public player agent portal.

That registration provided access to internal systems used in the tournament's live broadcast infrastructure, creating a path to hijack the broadcast.

We created a course to tackle these security problems within tenants.

Our Tenant Zero course examines the tenant security weaknesses behind this scenario, how they could have been prevented, and includes hands-on labs to reinforce the concepts.

Try it on SecDim Learn: https://learn.secdim.com/course/tenant-zero

Win Prizes at DEF CON 34 | Submit a Challenge Now!

Hamza — Thu, 18 Jun 2026 06:38:40 +0000

The Prizes for the SecDim AppSec Village Wargame CtF at DEF CON 34 has been announced!

Build and submit a challenge and get a chance to Win a ROG Xbox Ally if your challenge submission wins 1st Place!

Challenge submissions close on 31 July.

https://sessionize.com/appsec-village-wargame

New GCP Challenges Released

Hamza — Wed, 17 Jun 2026 07:34:47 +0000

We’ve expanded our Google Cloud Platform (GCP) challenge catalogue with a new set of hands-on cloud security scenarios covering common services and configurations.

These challenges focus on security issues and misconfigurations commonly encountered in cloud environments, giving practitioners practical experience identifying and remediating them.

Try them now on SecDim Play!

👉 https://secdim.com/news/new-gcp-security-challenges-19187/

NDC Sydney 2026 AI Wargame Winners

Hamza — Tue, 16 Jun 2026 02:19:03 +0000

We held an AI Wargame at NDC Sydney 2026.

Congratulations to the Winners: zakazai, Brendon Atkins and wicksipedia

They finished at the top of the leaderboard after tackling challenges covering exploitation, secure coding, and vulnerability remediation in AI applications.

Thanks to everyone who participated. We look forward to the next one.

50 days Left! - Submit a challenge for AppSec Village at DEF CON 34.

Hamza — Thu, 11 Jun 2026 08:02:17 +0000

There are 50 days remaining to submit a challenge for the SecDim "Fix the Flag" competition at AppSec Village™, DEF CON 34.

Build a vulnerable application, define the intended fix, and put defenders to the test.

If you've ever looked at a security vulnerability and thought "this might be a challenge to patch", now is your chance.

Submissions will be featured in the Wargame competition, with prizes for the best ones provided by XBOW.

👉 https://sessionize.com/appsec-village-wargame

Why you should not use JavaScript sandbox

Hamza — Wed, 10 Jun 2026 04:39:39 +0000

We previously highlighted comments from the vm2 maintainers acknowledging that future sandbox escapes are likely and that vm2 should not be relied upon as a sole security control.

We promised a write-up. Here it is.

Using the recent vm2 escape (CVE-2026-22709) as a case study, we ask:

Can an in-process JavaScript sandbox ever be treated as a security boundary?

We examine why sandbox escapes continue to occur, the architectural challenges behind them, and why stronger isolation models are often a better investment when executing untrusted code.

The core flaw is that vm2 attempts to enforce isolation inside the same language runtime, which has no concept of privilege separation.

The approach taken to patch the vulnerability is to wrap a finite set of intrinsics and methods (e.g. Promise) that could lead to a sandbox escape. This design decision has the same failure mode as a blacklist. We disallow a finite set of items that we know can cause harm. If we miss an item, type, path, or introduce a new object, a sandbox bypass can emerge.

If application security is implemented merely by chasing exploitable scenarios, it shows a deep insecure design flaw. This approach does not guarantee safety and it remains open for future exploitation.

Read the entire article here:

👉 https://secdim.com/blog/post/why-you-should-not-use-javascript-sandbox-19165/

CtF Submissions for DEF CON 34 are now open.

Hamza — Wed, 03 Jun 2026 07:41:07 +0000

Challenge submissions for the AppSec Village Wargame Contest at DEF CON 34 are now open.

Think you have what it takes to make the most interesting AppSec challenge? Now is a good time to get started.

Build challenges with the Open Source SecDim Play SDK and win prizes at DEF CON 34.

👉 https://secdim.com/defcon/

Coming Soon: vm2 and JS Sandboxes

Hamza — Tue, 02 Jun 2026 03:31:08 +0000

The maintainers of vm2 have been honest about its limitations.

They have been explicit that new sandbox bypasses are likely to occur and that vm2 should not be relied on as a sole security control.

It is a welcome trend to see maintainers openly discuss the limitations and security assumptions of their projects.

Later this month, we'll be publishing a write-up on vm2 and the security implications of JavaScript sandboxes. Stay tuned.