Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Record the login flow
Open /login through Auth Builder, sign in as User A, store the DOM identity immediately, and verify /auth/me through Replay as Identity.
Capture browser state
Inspect cookies, localStorage, sessionStorage, origins, and token candidates. Redact values in previews and name the identity by user and role.
Use the browser companion
Capture a request from the companion, send it to HTTP Forge, and verify the selected stored identity replaces stale manual authentication.
Verify DOM XSS
Launch the hidden isolated Playwright context for /xss/dom-insecure, capture execution evidence and a screenshot, then close the context on success, timeout, or cancel.
Test timeout cleanup
Use a short timeout against a non-executing secure page. Confirm the browser process and temporary context are removed and the result is inconclusive, not vulnerable.
Prove it before moving on.
The project contains distinct identities, sanitized browser state, one execution proof, one safe timeout, and no leaked browser process.