// the half-baked code challenges

Code that passed review. Crashes in production.

Real bugs from real codebases — the kind that look fine in dev, sail through code review, and only surface under load or in edge cases. Spot the bug, get the full breakdown in your inbox.

5 active challengesnode.js · async · security · db3–15 min each

Active challenges

5,449

Total attempts

35%

Avg solve rate

~8min

Avg time to crack

// pick a challenge

Five bugs, one assumption: it works on your machine.

Filter by difficulty or category. Each card shows a code preview — full solution lands in your inbox after you submit your guess.

// difficulty

// category

easyNode.jsMemory⏱ 3-5 min

// challenge_01

The WebSocket That Won't Forget

This WebSocket handler looks clean but will slowly consume all your memory.

websocket.js

const WebSocket = require('ws');
const EventEmitter = require('events');

const notifications = new EventEmitter();

const wss = new WebSocket.Server({ port: 8080 });

1,567 attempts58% solved

Try it →

mediumDatabaseNode.js⏱ 5-10 min

// challenge_02

The Connection Pool That Never Releases

This query function works perfectly in testing but will bring down production.

queries.js

const { Pool } = require('pg');

const pool = new Pool({
  max: 20,
  connectionTimeoutMillis: 5000,
});

1,089 attempts42% solved

Try it →

hardSecurityNode.js⏱ 10-15 min

// challenge_03

The Security Hole in String Comparison

This auth check leaks one byte at a time. Enough requests, your signing key is gone.

auth.js

const crypto = require('crypto');

function verifySignature(token, secret) {
  const [header, payload, signature] = token.split('.');

  // Recreate the signature
  const data = `${header}.${payload}`;

654 attempts18% solved

Try it →

hardNode.jsAsync/Await⏱ 10-15 min

// challenge_04

The Race Condition in Your Cache

This caching logic seems bulletproof but has a subtle race condition.

cache.js

class UserCache {
  constructor() {
    this.cache = new Map();
  }

  async getUser(userId) {
    // Check cache first

892 attempts21% solved

Try it →

mediumNode.jsMemory⏱ 5-10 min

// challenge_05

The Memory Leak That Passed Code Review

This Node.js stream implementation looks fine but will crash your server under load.

server.js

const http = require('http');
const fs = require('fs');

const server = http.createServer((req, res) => {
  const filePath = './large-file.pdf';

  // Stream the file to the response

1,247 attempts34% solved

Try it →

// how_it_works

How the challenge format works.

No login, no streaks, no leaderboard. Just real bugs and real solutions.

Read the code.

Each challenge is a real piece of code that passed code review at some point. Look for what's missing, what's assumed, what breaks at scale.

Submit your guess.

Drop your email and a short answer. No grading — just a way to compare your read against the actual root cause.

Get the full breakdown.

Solution lands in your inbox: what's wrong, why it passed review, the fix, and why the fix matters. Plus the next challenge when it drops.

Code that passed review. Crashes in production.

Five bugs, one assumption: it works on your machine.

The WebSocket That Won't Forget

The Connection Pool That Never Releases

The Security Hole in String Comparison

The Race Condition in Your Cache

The Memory Leak That Passed Code Review

How the challenge format works.

New challenge every 2 weeks.