A challenge is a short scenario where you make the decisions. Each one builds on a lab: open the lab first, or jump straight in.
Decide which roles may perform each action, then defend your permission matrix against tricky requests.
A fictional app's server lets requests through that it should refuse. You investigate what is wrong, fix its access rules, and the server is tested against requests you haven't seen.
Choose between hashing and encryption for a series of real-world needs, and justify each choice.
A leaked backup shows what Base64 and plain SHA-256 really protect, and why plain SHA-256 must never be trusted alone with a password. Then you choose the right technique for a password, a private address, a photo in JSON and a checksum.
Make a comment box safe to display, without breaking the comments people actually write.
A comment box and a name field show whatever strangers type. You pick the fix for each, and a fixed set of harmful and ordinary inputs is run through your choice.