Find all the support you need on your Veracode journey.

Some examples of usage that all still generate a CWE 117 flaw:

logger.debug('An example log: %r', database_object.uuid)

logger.debug('An example log : %s', repr(database_object.uuid))

logger.debug(f'An example log : {repr(database_object.uuid)}')

logger.debug(repr(f'An example log : {database_object.uuid}'))

How should I be using the sanctioned cleansing functions in this case?

We've just posted our June 2026 product update, and there's a lot to be excited about. From AI-powered fix improvements that are already live in your environment, to a featured Early Access opportunity for Fix for SCA, to upcoming changes in DAST, Analytics, and more.

Head over to the Product Updates page to read the full breakdown:

👉 community.veracode.com/s/product-updates

Note: The Product Updates page is available to logged-in community members. To access it, log in to the Veracode Platform first, then navigate to the Community — or click the link above and you'll be prompted to sign in. If you run into any trouble accessing it, email us at customersuccess@veracode.com and we'll help you get in.

Starting on June 30th, Veracode Policies will support the latest version of OWASP Top 10. If you are using either the ‘Auto-Update OWASP’ rule or the ‘Auto-Update PCI’ rule in your policy, your applications will automatically be re-evaluated against the new standard within 24 hours. If you are using the ‘OWASP 2021’ rule in your policy, however, you will need to replace it with an auto-update rule to use the newer version. For additional information, please review the attached FAQs and this page in the Veracode documentation center. Thank you.

To complete this challenge, you will need to perform a number of steps to decode/decrypt a cookie, then to create an encoded/encrypted cookie. You may find it helpful to open the web app in a new tab to inspect the cookie it provides more easily.

1. Visit the provided web app URL
2. Try out some passwords
3. Check your cookies
4. HTML decode
5. Base64 decode
6. MD5 decrypt
7. Reverse the above process for the original admin user (hint: guess the admin's original user ID)
8. ????
9. Welcome to the admin section!

 If you use a tool like 

curl

, be sure to include the header argument 

--header 'Origin: https://securitylabs.veracode.com'

 to bypass a warning page for accessing the web app.