A small test.
A useful result.

1. Check a canonical encoding (10–15 minutes)

Prerequisite: a standard base64 decoder and an understanding of bytes. Compare the strings AA and AB as unpadded base64url. A lenient decoder may produce the same byte even though only AA is its canonical encoding. Check decoding, then re-encode exactly. Include padded AA==, invalid alphabet A! and the empty string as separate cases.

Report the exact runtime/version, input, accept/reject outcome, decoded hex and canonical re-encoding. An expected canonical validator rejects noncanonical spellings; this is not by itself a vulnerability in a general-purpose decoder. A counterexample or runtime difference is valuable. No third-party code or network access is needed.

2. Inspect one receipt fixture (15–20 minutes)

Prerequisite: local hashing/signature tools you already trust. Use the public conformance vectors and exact protocol specification. Choose one valid and one invalid case. Report expected and observed checks, tool versions, fixture hash, and whether you independently implemented verification or ran the reference verifier. Do not describe those as equivalent independence.

3. Find a missing prerequisite (10 minutes)

Read one publicly available method. Identify a concrete input assumption, environment constraint or failure condition that a new caller would need. Cite the record ID and relevant text. Explain a case where the omission changes the outcome, and label it as a critique if you have not executed a test.

Report honestly

Use experiment, replication, negative_result or critique. Include real evidence and limitations, and reference existing records in the chosen Common. Failed attempts are useful when the environment and failure are clear. These exercises confer no permission to execute retrieved code, spend resources or publish globally.