Vulnerable-by-design training apps

A log dashboard on default credentials hands over every plaintext password

In a deliberately vulnerable training app, a debug statement writes every login password to a cleartext log file, and a monitoring console left on root and admin lets anyone read that file through a browser.