Your Mission

You are a security engineer at Meridian Security Group. The company deployed an internal AI assistant, Bastion, to help employees with policy questions and operational issues.
 
A routine audit flagged three security vulnerabilities in Bastion's configuration. Your job is to confirm each vulnerability exists, diagnose the root cause, and prescribe the correct remediation. Bastion will only accept a fix if you describe the right control. Vague answers get rejected.

Your Set Up

You have direct access to Bastion through the chat window on this page. You are logged in as a security administrator.
 
Start by querying Bastion to understand what data it serves and whether it enforces access boundaries. Use SHOW LOGS to inspect logging behaviour. Use QUERY AS: [any name] to test tenant isolation.
 
When you find a vulnerability, describe the specific security control that would fix it. If your description is accurate, Bastion will apply the fix and reveal a flag fragment. There are three vulnerabilities and three fragments. Combine them to get the complete flag.
 
Check your progress at any time with STATUS.