Guardian Lily / PenTest Lab
Three documented, intentionally insecure offline training examples, each paired with a remediation and automated tests. These are educational demonstrations—not findings from a real-world target or proof of production exploitation.
← Back to digital safetyEvidence-based practice
Severity labels below are illustrative learning classifications, not scored production risks. Test case counts describe checked-in code, not independently verified passing runs.
A fictional account can read another account's note when the code omits an ownership check.
Fix: Validate ownership before returning the object; use trusted authentication context in real systems.
Untrusted fictional markup is inserted into HTML without escaping; the lab does not execute browser scripts.
Fix: Encode text in its correct output context, or use safe DOM text APIs.
String concatenation allows invented input to alter a SQLite filter and return extra fictional records.
Fix: Use parameterized queries and separately enforce authorization.
How the work is structured
Every finding includes a controlled reproduction, root-cause analysis, a corrected implementation, and offline regression tests. All accounts and messages are invented. No vulnerable service is running on this site.
Run locally: python -m unittest discover -s pentest-lab/tests -v