Practice catalogue updated Fri, Sep 25, 2026

Debug the signal.
Ship the fix.

Production-shaped debugging labs across APIs, config, concurrency, and infrastructure. Reproduce the failure, follow the evidence, and prove the smallest safe change.

Ready labs145playable now

Quick starts100under 20 min

Avg. time19minper lab

OSS labs4public history

01Reproducemake the failure visible

02Tracefollow the evidence

03Patchchange the smallest thing

04Verifyprove it holds

Featured labBuglyst · CI/CD & Pipelines

The Failure That Disappeared In The Aggregate

A failed continuable step is recorded but the stage aggregate still reports ok:true.

Hard26 minJavaScript#track#ci-cd-pipelines#continue-on-error

all labs · ready to play

Choose a failure mode.

Focused bugs are targeted exercises; codebase incidents are deeper, production-shaped investigations with architecture, logs, and multiple layers. Search by symptom, then filter by lab type, source, status, or difficulty.

press / to search

12 of 145 labs · "Auth"ready labs · catalogue order

#LabDifficultyTime

01Focused bugThe Phantom Env VarWorks locally. Fails in CI after a config change.63 attempts · 28 solved · 1 discussionsEasy12min 04Focused bugAccessDenied at 3AMProduction job fails only after rotating credentials.23 attempts · 10 solved · 0 discussionsMed.22min 21Focused bugThe Permission That Outlived the UserSecurity revokes a contractor. API logs still show successful deletes.1 attempts · 0 solved · 0 discussionsMed.15min 25Focused bugThe Retry That Amplified OutagesWhen auth fails, clients hammer it harder. Traffic multiplies the outage.3 attempts · 1 solved · 0 discussionsEasy12min 26Focused bugThe Header That Vanished Mid-FlightAuthenticated upstream calls 401 even though the client set Authorization.0 attempts · 0 solved · 0 discussionsMed.15min 31Focused bugThe Token That Never ExpiredRevoked sessions still authorize long after their expiresAt.0 attempts · 0 solved · 0 discussionsMed.15min 101Focused bugRedirect drops authorizationAuthorization header is stripped when following a 3xx redirect.3 attempts · 0 solved · 0 discussionsEasy12min 106Focused bugInner join drops comments from soft-deleted authorsA LEFT JOIN needs an INNER JOIN — or vice versa — and rows silently disappear from the listing.1 attempts · 0 solved · 0 discussionsEasy15min 126Focused bugThe Token That Never ExpireCheckedJWT verify path accepts expired tokens and rejects unexpired ones because it reads the wrong claim.0 attempts · 0 solved · 0 discussionsEasy12min 127Focused bugThe Payment Key That Ended Up In The LogsPaymentError's message embeds the request, including the Authorization header that holds the API key.0 attempts · 0 solved · 0 discussionsMed.18min 128Focused bugThe Constant-Time Compare That Compounded The OppositeHMAC verify path accepts forged signatures and rejects genuine ones — the bitwise compare is inverted.0 attempts · 0 solved · 0 discussionsHard24min 145Codebase incidentThe token that only fails after deployValid API tokens work locally but production rejects them because configuration precedence selects the wrong audience.1 attempts · 0 solved · 0 discussionsHard35min

discussion · public Practice

What are developers debugging?

Questions, dead ends, and useful investigation clues from real public Practice threads.

latest threads

Loading discussion threads…

real activity · public practice

What developers are doing.

Recent public activity from developers who chose to share their Practice work.

Loading recent public activity…

keep building the loop

More ways to practice.

Move from a focused drill to open-source history or company-style patterns when you want a different kind of debugging pressure.

Focused exercises

Train code review, system tracing, CI diagnosis, incident response, and fast debugging instincts.

05 drills5 formats · short sessions

Open-source labs

Practice against safely recreated public bug-fix history from the libraries that actually broke.

04 playablereal bug-fix history

Company-style prep

Train backend and infrastructure failure patterns without affiliation claims.

30 patternsPattern-based · unofficial