Skip to main content

Instructor quick start

Browse all lessons in the exercise catalog: open root index.html from an extracted repository in a browser. GitHub displays the HTML source rather than running it.

Local-server password-storage lesson​

For password storage, use 07 Cryptographic Failures. Allow 75–90 minutes after setup with Node 22+, browser and editor. Students replace two helper calls, restart, recreate the fictional account, and verify storage and login behavior. The teaching plan explains memory needs, assessment and safe local use. Export with node tooling/package-student-kit.mjs 07-cryptographic-failures node ./dist/password-storage. The starter passes five and fails two checks; the repair passes all seven.

Local-server configuration lesson​

Use 06 Security Misconfiguration to teach safe public error responses. Students need Node 22+, a browser and editor; no dependencies or prior server programming. They disable one debug setting, restart, and verify that diagnostics disappear from the actual HTTP response while the failure status and normal functionality remain. Follow its teaching plan.

From the repository root: node tooling/package-student-kit.mjs 06-security-misconfiguration node ./dist/misconfiguration. Run node server.mjs inside the exported app folder, then open http://127.0.0.1:3000. Stop with Ctrl+C before running node checks.mjs in that folder. The starter intentionally fails one disclosure check; the solution passes all. Keep the app local. This is an A02 configuration example, not a CVEL-detected dependency vulnerability.

Local-server ownership lesson​

For a guided introduction to authorization, use 05 Broken Access Control. Students need Node 22+, a browser and an editor, but no package installation or prior server programming. The supplied server uses fictional records and a fixed demo identity. Students change only authorize.mjs, then verify allowed and denied requests. Follow the teaching plan.

From the repository root export with node tooling/package-student-kit.mjs 05-broken-access-control node ./dist/access-control. In the exported kit's app folder, run node server.mjs and open http://127.0.0.1:3000. Stop with Ctrl+C, then run node checks.mjs from that same folder. Expect deliberate failures before repair, all passes after. Keep the vulnerable starter local; do not deploy it. This teaches an A01:2025 ownership example, not a vulnerability detected by CVEL.

Browser-only lesson​

For introductory browser JavaScript, start with 04 Browser Security Basics. Open its student/index.html, review the instructor walkthrough and safe solution, and test the local demonstration. No student terminal, Node, npm, server, or network access is needed. Instructors can export with node tooling/package-student-kit.mjs 04-browser-security-basics browser ./dist/browser-security from the repository root. The kit opens at app/index.html.

This lesson teaches one XSS example within OWASP A05:2025 Injection. CVEL does not detect that application-code flaw. Follow the exercise-specific safety instructions; only its harmless local demonstration is permitted.

Dependency lessons (01–03)​

Teach 01 first unless students already know dependency/advisory interpretation and reviewed remediation. Read the beginner primer together; allow 15–20 minutes for its annotated report and readiness questions. Exercises 02–03 are independent file bundles but assume 01 or equivalent knowledge. Allow about 30 minutes as follow-ons, or 45–60 minutes for prepared students new to each activity; setup and optional hosted CI are additional. Each has its own rubric, not a hidden requirement to submit the manual exercise again.

  1. Choose a lesson and ONE manager track. Allow setup time before class; the advertised lesson time excludes downloads and failures.
  2. Read docs/setup.md and docs/safety.md. Install the manager version, prewarm the pinned scanner and run the selected student example.
  3. Read the exercise instructor/walkthrough.md and rubric.md. Inspect the before/after report snapshots and provenance for that manager.
  4. Export a student kit using the command in the root README. Test it in a fresh folder with the kit's MANAGER-SETUP.md. Distribute the kit folder through your LMS; students do not need this repository's other exercises.
  5. Tell students what evidence to submit using submission-template.md. Decide whether AI is permitted and whether CI runs will be local or on GitHub.
  6. Keep the worked solution for the debrief. The example uses axios 0.21.1 and lodash 4.17.20; the reference solution uses axios 1.20.0 and lodash 4.18.1.
  7. Refresh live scan expectations before each term. Current reports can legitimately differ from snapshots. Never mark a reasoned answer wrong merely because advisory counts changed.

Reference-report fallback​

If network access fails, exported dependency kits include the selected track's historical reports and provenance in reference-reports/. Students analyze differences and propose commands but clearly label unexecuted steps. For exercise 02, the kit includes prompts/sample-response.md; no-account students may skip skill installation. Keep instructor/sample-response-critique.md as the answer key until the debrief. For exercise 03, synthetic cases in scenarios/ let students run the helper without a live scan. Do not confuse these cases with scan evidence or invent a hosted run.

Teaching schedule​

Manual: 10 min inspect, 10 scan, 10 investigate, 15 fix/test, 10 rescan, 5 reflect. AI: 5 min install/read skills, 10 propose/critique, 10 approved fix/test/rescan, 5 reflection. CI: 5 min inspect template, 10 local failing gate, 10 remediate/retest gate, 5 distinguish failure causes. Optional hosted run may take longer.

Screenshot preview