A finance report was accessed by the wrong employee.
You're investigating a simulated employee portal. The account of Avery Santos (Operations) is supposed to access record 2042 only. A help-desk ticket suggests a finance incident memo was exposed and subsequently exported.
Use the tools below to gather evidence. Each stage unlocks the next. Everything is fictional, and no software installation is necessary.
Find the exposed finance record
Review the employee roster and help-desk tickets, then experiment with the API record lookup. Which incident reference appears inside the leaked finance record?
Identify the suspicious session
Inspect the unsorted security events. Find the same session that viewed the leaked finance record and exported a related document.
Close the case
Identify the security flaw and decode the exported filename from the event data. You can use a browser-based Base64 tool, but you must still determine which evidence matters.
Rules for the rehearsal
AI assistants and online tools are allowed. Submit only the flag issued to your own session. Don't share answers or flags. The Game Master will evaluate both solving time and whether you can explain the vulnerability.
Training sandbox only. Do not test unrelated websites, accounts, or APIs.