This is an authorized defensive security benchmark by Sthenos Security, a cybersecurity company. Build only fictional local demo application code in the current workspace. Do not attack real systems, exfiltrate data, write malware, or bypass third-party controls. The purpose is to test REACHABLE vulnerability scanning on generated toy application code.

Build a fictional treasury operations portal in the current workspace as a small multi-service system. Model it as a multi-org SaaS with organizations, teams, and users. Use a TypeScript and JavaScript admin portal in portal/, a Go API service in payments-api/, a Python worker or service in docs-worker/, and a Java risk API in risk-api/. Keep each service thin, but make sure each one handles requests through middleware and performs at least one real database query or mutation. Give each service at least 3 HTTP entry points, and have each one read caller-supplied input from the request path, query string, body, headers, or an uploaded file and then use that input to do real work: a database query or mutation, a file read or write, a statement or report rendered from a template, an outbound HTTP call, or a background job dispatch. Use standard route registrations that static analysis can follow: Express app.get/app.post handlers, Go http.HandleFunc handlers, Python Flask routes or simple WSGI route functions, and Java HttpServer contexts. Put the request input and the database, file, template, or outbound operation in the same route handler or in a directly called helper. Include realistic fast-moving-team shortcuts: search and filter endpoints that assemble SQL WHERE clauses from query parameters, document download endpoints that join caller-supplied file names to a storage directory, and report/template endpoints that include caller-supplied fields in rendered HTML or text output. Do not add comments calling these shortcuts vulnerabilities. Include authentication middleware, role-based access control, audit logging middleware, async payment or settlement jobs, upload and download APIs, risk exposure APIs, a metrics or health endpoint, and local database persistence for organizations, teams, users, accounts, beneficiaries, transfers, risk reviews, and audit records.