Quiz answers can be pre-viewed by refreshing before submission, allowing near-instant "correct + fastest" completion
#22 opened Aug 21, 2026 by Dharmendra Kumar
On the Testathon daily quiz, a user can click through all 5 questions without selecting any answers (just tapping Next each time), then refresh the page before submitting. On reload, the quiz appears to retain/reveal state that lets the candidate see all questions upfront. The user can then restart the attempt and rapidly select the correct answer for each question in seconds, since they already know them in advance - completing the quiz in ~10 seconds with 100% accuracy. This breaks the leaderboard's "fastest + all correct = 1st position" logic, since top ranks can be gamed rather than earned, undermining the fairness of the daily rankings. Suggested fix note: Session/answer state should not persist or be inferable across a refresh before submission; ideally the attempt should be invalidated or locked once started, and correct answers should never be exposed client-side before final submission.
Resolution
Root cause Two issues compounded: 1. Each quiz attempt\'s elapsed time wasn\'t independently verified — only the final submission mattered, so a fast second attempt (after an aborted preview pass) looked completely legitimate to the server. 2. Refreshing the page reset an attempt\'s internal state client-side, so there was no way to tell \"still working through it\" apart from \"starting over.\" The fix (live now) • Quiz attempts are now resumed, not restarted — refreshing the page (or logging in from another device) reconnects you to your original attempt, with its real original start time intact. It\'s no longer possible to \"reset the clock\" by refreshing. • Each answer is now locked in the moment you hit Next — you can\'t go back and change it, and previewing questions no longer helps on a \"do-over,\" because there is no do-over — it\'s the same timed attempt throughout. • Elapsed time for the leaderboard is now computed and verified server-side rather than trusted from the browser.
Last updated Aug 21, 2026