Scanner installation fails: check Node version, registry/proxy access and native SQLite build logs. Do not install the scanner into the vulnerable app to work around the issue. Ask the instructor to preinstall tooling or use captured-report analysis.
Network/advisory errors: inspect status, complete and diagnostics. A missing/partial report is not zero findings. Do not turn network errors into successful security checks.
Wrong manager selected: work in the proper track, with one lockfile. Start a fresh kit rather than deleting files from another project.
Frozen/immutable install fails: check the documented manager version and unchanged manifest/lockfile. Do not regenerate the student lockfile casually; it can change the lesson.
Yarn Berry asks for another project root: use the supplied packageManager field and .yarnrc.yml; choose a folder outside another Yarn workspace.
Bun installed but Node missing: Bun manages this track's packages; application tests deliberately run using Node for cross-track consistency.
Windows: commands avoid Unix env syntax and destructive shell operations. Global tool paths and native build setup may still differ; Windows has not been verified unless listed in the matrix.
Different findings: record date, tool version and report. Advisory databases change. Investigate the discrepancy, retain artifacts, and use snapshots as historical examples only.
AI does not load instructions: read generated files and provide the analysis prompt explicitly. Merely generating a file does not guarantee an assistant reads or follows it.
Gate fails after fix: inspect whether findings remain, lookup was incomplete, or the scanner could not start. Do not add continue-on-error to make the security step green.