# Security policy

Flagship Lab #001 is intentionally vulnerable educational software. Run it locally only and never expose it to a public or shared network.

## Intended behavior

The documented push-option parsing weakness and constrained exploit chain are the subject of the lab. Reports that only reproduce the intended Learning Lab or Research Lab behavior are not security vulnerabilities in this repository.

## Unintended security issues

Please report issues that cross or weaken the intended lab boundary, including:

- escape from the isolated executor;
- arbitrary command execution beyond the lab-owned allowlist;
- access to the Docker socket or host files;
- unintended network exposure;
- authentication bypass outside the documented design;
- proof values exposed without completing the corresponding behavior; or
- dependency vulnerabilities that put users at risk outside the intended lab boundary.

Do not open a public issue for an unintended vulnerability. Use GitHub Private Vulnerability Reporting or create a private security advisory for this repository. Avoid including generated `.env` contents, proof values, unrelated credentials, or personal data.

## Maintainer checklist

- Enable GitHub Private Vulnerability Reporting in the repository's **Settings → Security → Code security and analysis** page.
- Keep security advisories private while triaging and coordinating a fix.
- Verify that any fix preserves the intended exercise while closing only the unintended boundary failure.