Google releases deliberately flawed micro-blogging app

Google has released deliberately buggy code to teach developers what not to do

Google has released a new micro-blogging application that is riddled with security holes and designed to act as a guide for developers.

The Jarlsberg application is for developers who want to improve the security of their code. It includes flaws that can be easily fixed as well as more complex problems that require source code access.

"Jarlsberg was written specifically to teach about security," said the company in a blog post. "More specifically, it is a tool to show how to exploit web applications and, in turn, protect against those exploits when developing software."

The application displays problems with cross-site scripting, cross-site request forgery and cross-site script inclusion, as well as client-state manipulation, path traversal and Ajax and configuration vulnerabilities.

The code has been released as part of Google's Codelabs training system, which seeks to improve code security and flexibility.

Google warned developers that they download the Jarlsberg app at their own risk, but hope it will provide some useful pointers.