Your question is Web Application Vulnerability Identification. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Identify vulnerabilities in the presented web application.
Review the application as an attacker and defender. For each finding, demonstrate or describe the exploit path, affected asset, STRIDE category, severity, and remediation. Cover authentication, authorization, input handling, session management, sensitive data exposure, browser security, dependency risk, and observability where applicable. Prioritize findings by exploitability and impact, and explain how you would verify that fixes work without introducing regressions.
