Lab Catalog
Hands-on environments you can spin up on demand. Browse freely; sign in when you want to start one.
21 labs
Search and filterAdmission Policy as Code
Express your security standards as admission policies, test them against manifests that should pass and manifests that should not, and roll them out in audit mode before they start blocking deployments.
Answering a Zero-Day with an SBOM
Generate SBOMs for a set of build artifacts and use them to answer, in minutes rather than days, which deployed services contain a newly disclosed vulnerable component.
Catching Infrastructure Misconfiguration Before Apply
Scan Terraform for the misconfigurations that become public buckets and open security groups, fix them, and wire the scan into the plan stage where it blocks a merge.
Container Escape and the Controls That Stop It
Break out of a deliberately misconfigured container to reach the host, then apply the runtime and admission controls that make the same escape fail.
Custom SAST Rules That Catch What Defaults Miss
Write, test and tune your own static analysis rules against a vulnerable codebase, then judge them on false positives as well as on what they catch.
Cutting Cloud IAM Down to Least Privilege
Find the over-permissioned roles in a cloud account, use access data to derive the permissions actually in use, and tighten the policies without breaking the workloads.
DAST Against an Ephemeral Environment
Stand up a per-merge-request environment, run an authenticated dynamic scan against the running application, and turn the results into a pipeline gate that does not flake.
Detection as Code with Grafana
Define alert rules and dashboards as version-controlled code, test them against replayed attack telemetry, and ship them through a pipeline like any other artifact.
DevSecOps Incident Response Game Day
Run a live compromise of a pipeline and cluster end to end: detect it, contain it, evict the attacker, and produce the timeline and control changes that come out of it.
Exfiltrating Secrets from a CI Pipeline
Steal pipeline credentials through a malicious build step and a poisoned dependency, then lock the pipeline down with scoped tokens, isolated runners and protected environments.
Gating Builds on Vulnerable Dependencies
Add a dependency scan that fails a build on exploitable CVEs, then work through the upgrades, exceptions and expiry dates that keep the gate from being quietly switched off.
Hardening a Container Image
Take a bloated application image that runs as root and rebuild it as a minimal, non-root, reproducible image, measuring the vulnerability count at every step.
Kubernetes RBAC Privilege Escalation
Escalate from a limited service account to cluster-admin through over-granted RBAC verbs, then rewrite the roles and prove the same path is closed.
Leaked Credential, End to End
An AWS credential is sitting in your Git history. Detect it with gitleaks, rotate it, purge it from every commit with git filter-repo, and add the local and pipeline controls that stop it coming back.
Risk-Based Vulnerability Prioritization
Reduce thousands of raw scanner findings to the handful that matter, using exploitability, reachability and real exposure rather than CVSS score alone.
Runtime Secrets Management
Move hardcoded application secrets into a managed secret store issuing short-lived dynamic credentials, and confirm that a stolen credential expires before it is useful.
Runtime Threat Detection with Falco
Attack a running workload, watch the default Falco rules miss part of it, then write and tune custom rules that catch the behaviour without burying you in noise.
Shift-Left Security Scanning with Trivy
Find hardcoded credentials, vulnerable dependencies and insecure infrastructure code in a real repository before any of it reaches production.
Signing and Verifying Build Artifacts
Sign container images and provenance attestations in the pipeline, then enforce verification at deploy time so an unsigned or tampered artifact cannot run.
Testing API Authorization
Exploit broken object-level and function-level authorization in a running API, fix the checks, and add the automated tests that keep the fixes honest.
Workload Identity and Mutual TLS
Give each service a cryptographic identity, enforce mTLS between them, and confirm that an unidentified workload on the same network is refused rather than trusted.