Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Run bot validation
Send a normal user agent and then a Playwright/HeadlessChrome or X-Automation marker to /bot/secure and /bot/insecure.
The secure pair blocks the basic automation signal; the insecure pair permits it.
State the bot limitation
The validator checks basic or lightly evasive signals. It does not certify resistance to advanced browser automation, device spoofing, residential proxies, or behavioral mimicry.
Run the CSWSH Origin check
Use CSWSHValidator against /ws-secure with the allowed origin and a foreign origin, then compare /ws-insecure.
Test an action after connect
On a connection accepted from a foreign origin, send a subscription or event action and determine whether sensitive data is available. Handshake acceptance alone may not prove impact.
State the TLS limitation
The defensive helper does not implement a separate WSS/TLS certificate validator. Use WSHawk TLS Inspection for certificate, hostname, protocol, and chain analysis.
Prove it before moving on.
The report contains basic bot results, CSWSH Origin and action results, and explicit limits for bot sophistication and WSS/TLS coverage.