C-SWCM case studies
C-SWCM · Put your knowledge to work in context.
The Certified Secure Web Application Engineer (C-SWCM) is a vendor-neutral credential aimed at developers, application security engineers, and penetration testers who need to find, exploit, and fix weaknesses in web applications. It sits at the intersection of offensive testing and defensive engineering: rather than only recognizing vulnerability names, candidates are expected to reason about how a flaw arises in code or configuration, how an attacker chains it, and what remediation actually holds up. The C-SWCM case studies are 5 cases and about 1,844 words.
1The Login Endpoint That Leaks Timing
A team is reviewing its authentication service. Login accepts an email and password, looks up the user in a database, and compares the password hash with bcrypt.
422 words, about 2 min2Stored XSS in a Rich-Text Comment Field
A community site lets users post comments with basic formatting (bold, links, lists). The frontend uses a rich-text editor that produces HTML, and the server stores the HTML and renders it directly into the page.
361 words, about 2 min3SQL Injection Behind an ORM
An application uses an ORM for most queries, but a reporting module builds SQL by string concatenation for a date-range filter: WHERE created at BETWEEN ' + start + ' AND ' + end + ' . The inputs come from a web form and are validated with a regex that allows digits, dashes, and spaces.
339 words, about 2 min4Encrypting PII at Rest Under a Deadline
A company must encrypt customer PII (names, addresses, national ID numbers) at rest before an audit in 30 days. The database team proposes using AES-256-GCM with a single key stored in an environment variable on each app server.
372 words, about 2 min5Container Image With a Critical CVE at Release
A release candidate image scans with one critical vulnerability in a widely used compression library. The service processes uploaded archives, so the vulnerable code path is reachable.
350 words, about 2 min