.
├── app.py                    # entry point for the local lab
├── build.sh                  # creates the venv, installs dependencies, and runs checks
├── run.sh                    # starts the vulnerable app locally
├── pyproject.toml            # project metadata and tool configuration
├── gunicorn.conf.py          # deployment configuration for a production-style server
├── src/
│   └── security_lab/
│       ├── __init__.py
│       ├── config.py         # lab settings and valid tokens
│       ├── audit.py          # file-based audit logger
│       └── factory.py        # Flask routes and auth logic
├── tests/
│   └── test_api.py           # regression tests for vulnerable and secure modes
├── exploit.py                # proof-of-concept route attack script
├── pentest_harness.py        # CLI verification helper
├── BUILD_GUIDE.md            # build and OS details
├── WALKTHROUGH.md            # step-by-step lab walkthrough
├── SECURITY_REPORT.md        # summary of the mock vulnerability and fix
├── CONTRIBUTING.md           # contribution workflow
├── LICENSE                   # MIT license
├── requirements.txt          # pinned dependencies
├── .env.example              # sample environment configuration
└── .github/workflows/
		└── python-tests.yml     # CI validation for push and pull requests

chmod +x build.sh run.sh
./build.sh

./run.sh

curl -i http://127.0.0.1:5000/api/management/users

$ curl -i http://127.0.0.1:5000/api/management/users
HTTP/1.1 200 OK
Content-Type: application/json

{
	"users": [
		{"id": 1, "username": "admin", "role": "super-admin"},
		{"id": 2, "username": "operator", "role": "operator"}
	],
	"warning": "unauthenticated access allowed"
}

source .venv/bin/activate
python exploit.py --host 127.0.0.1 --port 5000

source .venv/bin/activate
python pentest_harness.py --mode vulnerable
python pentest_harness.py --mode secure
python pentest_harness.py --mode secure-strict

make lint
make test

git tag v0.1.0
git push origin v0.1.0