Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Prove the target boundary
Create or reopen the Academy Lab project and send GET /health. Continue only when the target is 127.0.0.1 and local_only is true. The public-recon lessons require a separately authorized target and are never run against an unrelated domain.
GET http://127.0.0.1:5177/health200 with "local_only": true.
Create findings from evidence
Save one IDOR and one SQLi result with stable IDs, endpoint, policy/family, identity aliases, request/response hashes, sanitized bodies, and replay steps.
Triage accurately
Use Open, Confirmed, Rejected, Fixed, and Inconclusive consistently. Edit severity for impact and confidence for evidence quality.
Consolidate duplicates
Repeat the same SQLi probe. Confirm matching endpoint, parameter, family, and normalized evidence are linked instead of creating a second independent issue.
Preview and export selected
Reveal protected evidence only when needed, copy the sanitized form, and export only the selected confirmed findings.
Retest
Run the stored replay after changing to the secure route. Classify Still vulnerable, Fixed, Authentication expired, Endpoint changed, or Inconclusive from actual behavior.
Prove it before moving on.
Each finding has one lifecycle state, explained severity/confidence, no duplicate, protected evidence, and a retest history.