Safety: local access-control practice

Use only this supplied application and its fictional records. Do not try ID changes against university portals, work systems or other websites without explicit authorization.

The starter is deliberately vulnerable. Run it only on your own computer using its default 127.0.0.1 binding. Do not deploy it, expose it through a tunnel, forward its port or change it to listen on the network. Stop it with Ctrl+C after the lesson.

There are no real accounts, credentials or records. Do not add personal information. The fixed demonstration identity is a teaching simplification, not secure production authentication. Denying other students' records does not make this a production-ready application.

No dependencies or remote services are needed for this exercise. Project links open online, but the app uses local assets and runs locally. CVE Lite CLI is not required for this authorization lesson.