github-solve-intelligence-test
GitHub README for xaid-vfx/solve-intelligence-test. Primary language: Shell.
Key extractions
This isn't a product — it's a black-box security assessment writeup of api.solveintelligence.com's /auth/signup and /auth/signin endpoints, mapped to OWASP API Top 10 (2023).
Findings (claimed Critical):
- API4:2023 (unrestricted resource consumption): no rate limiting. 200+ rapid signup requests returned 200 OK; 50+ failed logins with no 429 or lockout.
- API2:2023 (broken auth): user enumeration via distinct "No valid subscription..." error on signup confirms email existence. Demonstrated by identifying
chris@solveintelligence.comas registered. - API8/10:2023 (input validation / injection): all invalid inputs (oversized, malformed JSON, SQL injection payloads) return 200 OK with generic field error. No schema validation.
Recommendations: rate limits (5-10/min/IP signup, 3-5 failed/min/IP signin), uniform error messages, strict schema validation with proper 4xx codes.
Ethical framing: black-box, publicly accessible endpoints, no internal access, responsible disclosure.
Classification note
Treat as a deliverable / assessment rather than a shipped product. Status: shipped-report. Probably associated with an interview process or consulting engagement (repo name literally solve-intelligence-test).