The guided path

A day at the bank

Walk through the bank from the street to the vault, one short animated guide at a time. 42 stops in all.

0 of 42 stops walked. Saved in this browser only.

Start the journey
  1. TrailheadThe street
  2. Chapter 1

    The Front Door

    Every visitor starts on the street. The front door and the signs around it decide what the outside world can see, who can reach in, and where visitors get sent.

    0/7 lockedStill open
    You are here · Street, at the front door
    from the streetYou are hereSigns missing at the front doorSecurity headers · interactiveNot done yet.Handing statements to anyone’s messengerCORS · interactiveNot done yet.A forged slip riding on a real badgeCSRF · interactiveNot done yet.The greeter who walks you anywhereOpen redirect · interactiveNot done yet.The armored truck with one unlocked legMixed content · interactiveNot done yet.Tamper-evident seals on vendor deliveriesSubresource Integrity (SRI) · interactiveNot done yet.Blueprints left on the front counterExposed source maps · interactiveNot done yet.to the ID desk
  3. Chapter 2

    The ID Desk

    Alice made it through the front door. Now she needs a visitor badge, and whoever runs this desk decides who gets one, what it lets her do, and how long it lasts.

    0/5 lockedStill open
    You are here · Lobby, at the ID desk
    from the front doorAn ID desk that gives too much awayWeak login checks · interactiveNot done yet.The “I lost my key” process that opens the door for anyonePassword reset flaws · interactiveNot done yet.Visitor badges left lying aroundSession & token storage · interactiveNot done yet.Forging a signed badgeJWT attacks · interactiveNot done yet.Unlimited PIN guessesMissing rate limits · interactiveNot done yet.to the teller windows
  4. Chapter 3

    The Teller Window

    Alice has her badge. At the teller window she hands over slips and the teller does what they say, so everything a customer can write on a slip is something a robber can try.

    0/4 lockedStill open
    You are here · Teller windows, at the teller window
    from the ID deskSlips that give the teller ordersSQL & command injection · interactiveNot done yet.Notes that boss around every readerCross-site scripting (XSS) · interactiveNot done yet.Sending the teller to the back roomServer-side request forgery (SSRF) · interactiveNot done yet.The deposit slot that takes any parcelUnsafe file uploads · interactiveNot done yet.to the records room
  5. Chapter 4

    Account Access

    Behind the counter are the account records. Being let into the bank is not the same as being allowed to open every account, and that difference is what this room is about.

    0/6 lockedStill open
    You are here · Records room, in the records room
    from the teller windowsPeeking at someone else’s accountIDOR / BOLA · interactiveNot done yet.The service window nobody guardsRoutes without authentication · interactiveNot done yet.Walking into the manager’s officePrivilege escalation · interactiveNot done yet.Scribbling in the margin of the formMass assignment · interactiveNot done yet.Handing in oddly shaped slipsBody & parameter fuzzing · interactiveNot done yet.Drawers with no lock ruleDatabase access rules (RLS & Firebase rules) · interactiveNot done yet.to the vault
  6. Chapter 5

    The Vault

    A vault is only as safe as its keys. This room is about the keys left lying around, and the locks the bank bought from someone else.

    0/3 lockedStill open
    You are here · Vault, at the vault door
    from the records roomThe vault key in the old filing cabinetSecrets in git history · interactiveNot done yet.The combination printed on the brochureSecrets in the browser · interactiveNot done yet.The lock the vendor warned aboutVulnerable dependencies (CVEs) · interactiveNot done yet.to the building
  7. Chapter 6

    The Building

    Behind the walls is the building itself: the locks, the wiring and the maintenance crew who run it. A mistake made here gets copied into every branch.

    0/4 lockedStill open
    You are here · Back office, in the building’s systems
    from the vaultA prefab bank with the master key insideDocker misconfigurations · interactiveNot done yet.A bank campus with every door openKubernetes misconfigurations · interactiveNot done yet.A blueprint that builds the same mistake everywhereInfrastructure-as-code mistakes · interactiveNot done yet.Maintenance crews that trust every instructionRisky shell scripts · interactiveNot done yet.to the notice board
  8. Chapter 7

    The Blueprints

    Floor plans and staff directories help the bank run, and they help a robber too. This room is about what gets left in plain sight, and the doors nobody remembered to list.

    0/4 lockedStill open
    You are here · Lobby, at the notice board
    from the buildingDoors nobody remembered to lockHidden endpoints · interactiveNot done yet.Files left in the lobbyExposed files & risky HTTP methods · interactiveNot done yet.The service desk with everything on the menuGraphQL exposure · interactiveNot done yet.The staff manual in the lobbyExposed API docs (OpenAPI) · interactiveNot done yet.to the rulebook
  9. Chapter 8

    The Rulebook

    Every branch follows the same written rules, enforced by guards at the doors. A badly written rule, or a guard who does not cover every corridor, is a gap for everyone.

    0/2 lockedStill open
    You are here · Records room, at the rulebook shelf
    from the notice boardA ledger that was built wrongInsecure database schemas · interactiveNot done yet.A guard who skips some corridorsMiddleware coverage gaps · interactiveNot done yet.to the back office
  10. Chapter 9

    The Back Office

    Last stop: the processes behind the counter. Each step works exactly as written, but timing and business rules can still be gamed.

    0/2 lockedStill open
    You are here · Back office, in the back office
    from the rulebookTwo tellers, one balance, paid twiceRace conditions · interactiveNot done yet.Rules that work but can be gamedBusiness logic flaws · interactiveNot done yet.to the new hire’s desk
  11. Chapter 10

    The New Hire

    The bank has taken on a very fast new assistant. It reads everything, follows what it reads, and works without tiring. That is a gift and a risk, and this last room is about using it safely.

    0/5 lockedStill open
    You are here · Back office, at the new hire’s desk
    from the back officeA note slipped into the pilePrompt injection · interactiveNot done yet.Handing the new hire the keysSecrets leaked via AI tools · interactiveNot done yet.The supplier who doesn’t existSlopsquatting / hallucinated packages · interactiveNot done yet.Signing what you haven’t readTrusting unreviewed AI code · interactiveNot done yet.A master key for the new hireExcessive agency / MCP risks · interactiveNot done yet.to the finish line
  12. The finish lineEvery guide done means you have seen every way in.Open your to-do list