Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Verify project encryption
Confirm the Electron + Go project database uses content encryption and an OS-protected project key. Do not place the key inside an export bundle.
Test automatic redaction
Save /auth/refresh. Preview must mask access_token, refresh_token, cookies, Authorization, JWT-like strings, and private-key blocks.
Choose hash-only evidence
For a status/length comparison where the body is unnecessary, store only hash and metadata. Keep full encrypted content only when needed for semantic proof.
Apply retention
Set a short lab retention limit, expire old raw bodies, and verify finding metadata, hashes, and audit history remain usable.
Control reveal and copy
Require an explicit reveal action, copy sanitized content by default, and hide again. Record who exported what in the project notes.
Prove it before moving on.
A project inspection shows encrypted storage, masked secrets, minimal retained content, and intact reproducibility metadata.