Practice catalogue updated Mon, Aug 10, 2026

Debug the signal.
Ship the fix.

Production-shaped debugging labs across APIs, config, concurrency, and infrastructure. Reproduce the failure, follow the evidence, and prove the smallest safe change.

Ready labs138playable now

Quick starts99under 20 min

Avg. time18minper lab

OSS labs4public history

01Reproducemake the failure visible

02Tracefollow the evidence

03Patchchange the smallest thing

04Verifyprove it holds

Featured labBuglyst · Caching & Performance

Cache stampede without coalescing

Concurrent cold-cache callers each kick off their own expensive compute, overwhelming the worker.

Hard25 minJavaScript#track#caching-performance#stampede

all labs · ready to play

Choose a failure mode.

Search by symptom, then filter by source, status, or difficulty. The featured lab is highlighted at the top so you always have a strong place to start.

press / to search

11 of 138 labs · "Auth"ready labs · catalogue order

#LabDifficultyTime

01The Phantom Env VarWorks locally. Fails in CI after a config change.29 attempts · 4 solved · 1 discussionsEasy12min 04AccessDenied at 3AMProduction job fails only after rotating credentials.9 attempts · 1 solved · 0 discussionsMed.22min 21The Permission That Outlived the UserSecurity revokes a contractor. API logs still show successful deletes.1 attempts · 0 solved · 0 discussionsMed.15min 25The Retry That Amplified OutagesWhen auth fails, clients hammer it harder. Traffic multiplies the outage.0 attempts · 0 solved · 0 discussionsEasy12min 26The Header That Vanished Mid-FlightAuthenticated upstream calls 401 even though the client set Authorization.0 attempts · 0 solved · 0 discussionsMed.15min 31The Token That Never ExpiredRevoked sessions still authorize long after their expiresAt.0 attempts · 0 solved · 0 discussionsMed.15min 101Redirect drops authorizationAuthorization header is stripped when following a 3xx redirect.0 attempts · 0 solved · 0 discussionsEasy12min 106Inner join drops comments from soft-deleted authorsA LEFT JOIN needs an INNER JOIN — or vice versa — and rows silently disappear from the listing.0 attempts · 0 solved · 0 discussionsEasy15min 126The Token That Never ExpireCheckedJWT verify path accepts expired tokens and rejects unexpired ones because it reads the wrong claim.0 attempts · 0 solved · 0 discussionsEasy12min 127The Payment Key That Ended Up In The LogsPaymentError's message embeds the request, including the Authorization header that holds the API key.0 attempts · 0 solved · 0 discussionsMed.18min 128The Constant-Time Compare That Compounded The OppositeHMAC verify path accepts forged signatures and rejects genuine ones — the bitwise compare is inverted.0 attempts · 0 solved · 0 discussionsHard24min

discussion · public Practice

What are developers debugging?

Questions, dead ends, and useful investigation clues from real public Practice threads.

latest threads

Loading discussion threads…

real activity · public practice

What developers are doing.

Recent public activity from developers who chose to share their Practice work.

Loading recent public activity…

keep building the loop

More ways to practice.

Move from a focused drill to open-source history or company-style patterns when you want a different kind of debugging pressure.

Focused exercises

Train code review, system tracing, CI diagnosis, incident response, and fast debugging instincts.

05 drills5 formats · short sessions

Open-source labs

Practice against safely recreated public bug-fix history from the libraries that actually broke.

04 playablereal bug-fix history

Company-style prep

Train backend and infrastructure failure patterns without affiliation claims.

30 patternsPattern-based · unofficial