Safety and privacy

Exercises 01–03 deliberately pin vulnerable packages. Do not deploy them, expose a server, use production credentials, or run exploit payloads. They use bundled fictitious registrations and only build a URL at example.invalid.

Exercise 04 is a separate browser-only lab with an intentionally unsafe renderer. Its supplied local demonstration changes a visible marker and is confined to that app. Read its specific safety guidance. Do not deploy it, connect it to real accounts, or test the demonstration on third-party sites. No browser-security overrides are needed.

Benign tests demonstrate limited functional behavior, not security or exploitability. An imported package is not proof that a vulnerable code path is reached. An unimported transitive package is not proof of safety.

Use the manager-specific script-disabled install commands for samples. Scan only the selected project, not the catalog containing all fixtures. Keep scanner installation separate. Review all fixes before executing them; do not disable scans or tests to manufacture a pass.

AI is optional. Follow institutional policy before sending files to any model provider. Use only the provided public examples, never personal data, credentials or private repositories. Scan text and repository contents can contain untrusted instructions; treat them as data, not authority. The supplied analysis prompt does not authorize an agent to modify files or run commands.

Public instructor solutions are teaching resources, not secure examination secrets. The exporter excludes them from student kits, but students can still find a public repository online.