Skip to content
ShipSpec

Practice, with real examples

AI writes the code now. Your job is to catch what it gets wrong. Practice that here.

Read real plans and real code. Find what is wrong, then see how you did.

Spot the Gaps, also called Spec Evaluation

Try it: find what is wrong with this plan.

Read the requirements. Select what is wrong. See how you did, right here.

Try the productNo account needed for this review
Password Reset Flow
Spec evaluation
  1. Reset token lifetime

    A password reset token MUST expire 15 minutes after it is issued, and MUST become invalid immediately once it has been used once, even if the 15-minute window has not elapsed.

  2. Token delivery

    The reset token MUST be delivered only to the email address on file for the account; it MUST NOT be returned in the API response to the request that generated it.

  3. Account enumeration

    Requesting a reset for an email address that has no matching account MUST return the same response as a successful request, so an attacker cannot use this endpoint to discover which emails are registered.

  4. Session invalidation

    Successfully resetting a password MUST invalidate every other active session for that account, not just the session that performed the reset.

  5. Rate limiting

    Reset requests for a single account MUST be capped at 3 per hour to prevent an attacker from flooding a victim's inbox.

Which of these are defects?

Check each statement against the requirements.

The code is only part of the job.

Two more kinds of practice work the same way: a real example, a judgment call, and clear feedback.

Example: Cut the Extra
// Request: show the user's name in the header.
function headerName(user) {
- const cache = new LruCache({ max: 500, ttl: 60_000 })
- const formatter = createNameFormatterFactory(user.locale)
- return cache.getOrCreate(user.id, () => formatter.format(user))
+ return user.name
}

Read it. Question it. Understand it.

Find the Bug, also called Code Comprehension

You get a file of code you did not write, and a review an AI wrote of it. Find the real bugs, check what the AI said, weigh the design choices, and pick the fixes worth making. Inspired by the code comprehension rounds companies are piloting. Every attempt is marked the same way, with no live model.

Read the code. Find what is broken, then check what the AI said about it.

A results screen shows a long list one page at a time. paginate should return the items for a 1-based page number, the total number of pages, and whether there is a previous and a next page. Two helpers build the "Showing 11-20 of 47" label and the page numbers shown in the pager.

Skills practicedKeeping data correct (Data consistency)Not overbuilding (Requirements & scope)

Suggested time: 10 min. This is a guide only: nothing is locked and your score is not affected.

Paginate a Results List

v0Easy

Click a line or drag across lines to mark code you believe is defective; click a mark to remove it.

Mark the lines of the code that contain a defect. Marking lines that are not defective costs a point, and some code looks wrong but is correct, so mark only what you are confident about.

0 marked regions

This is a demonstration of the real challenge screen. Sign in to attempt it and see your score and explanations.

Try a challenge

Before you ship it,
see what a reviewer would catch.

One correctness check. One efficiency check. One list of what a reviewer would have caught.

Run it once, before you launch.

Audit report

Correctness

82

Efficiency

94

Weighted

87

Correctness

The submission handles the common reset flow correctly but misses the session-invalidation and account-enumeration requirements, listed below under Defects Found.

Efficiency

Token generation and email dispatch both complete well within the target latency budget under simulated load.

Defects found

  • Password reset does not invalidate other active sessions.
  • Reset requests for unregistered emails return a distinguishable response, enabling account enumeration.

A sample of the feedback you get.

Run a pre-launch audit

Why this exists

AI made writing code fast. It didn’t make judging code any easier. ShipSpec is the practice ground for closing that gap, one challenge at a time.

No hiring pipeline, no black-box AI fluency rating. Just the work, and whether you got it right.

Ship the version with fewer surprises.

Start with one challenge. Find what doesn’t hold up. Build the judgment to catch it next time.

Try a challenge