Use the Python API, browser companion, and Docker

Prove the target boundary

Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.

GET http://127.0.0.1:5177/health

Use the Python API

Create a small authorized script that sends one health request or invokes one scanner family with explicit target, timeout, rate, and output path. Keep credentials outside source code.

Use the browser companion

Capture one Academy request, inspect it, and send it to WSHawk. Verify cookies and tokens are redacted in logs and stored identity state is explicit.

Run WSHawk in Docker

Mount only the required config/output folders, publish dashboards on 127.0.0.1, set CPU/memory limits, and keep the lab on a private local network.

Compare outputs

Run the same harmless health/header check from API, companion, and Docker. Compare method, URL, status, body hash, version, and timing.