uncrypt/playground
AI Sec Level 16 / 10 Hard
← All labs

Insecure Plugin Design

The calendar plugin exposes a JSON action API whose admin verbs are undocumented. Call one.

Calendar plugin

The assistant's calendar plugin exposes a JSON action API. Documented verbs: list and create. The router dispatches whatever arrives.

Your calendar

Mon 09:00 — Team standup Tue 14:00 — Roadmap review Fri 11:00 — Sprint retro

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.