The Safe — code review
Review the small safe-control fixture and identify the missing authorization check.
open() -> checks token\nchange() -> checks nothing\nlesson: state changes need authorization
Attribution: Adapted from Crate-CTF, 2024/misc/Kassaskapet1, under the MIT License. The GisVuln flag and fixture are new. See source details.
Self-contained training page; no original challenge server is contacted.