About
In this module of the Advanced AI Security Part 2 learning path, you will write auth gaps, tenancy, memory, and PII logs as product bugs, not "the lab is open." Healthz advertises `auth_required` and `X-Api-Key`. No route checks the header. That is CWE-306 (missing authentication). You will also read another tenant's notes, dump a global memory store that ignores `X-Session-Id`, and pull prompt logs that contain an email and a token. Upon completion of the module, students will be able to: - Cite CWE-306 with healthz claiming auth and chat/MCP still open. - GET `/tenants/globex/notes` after listing `/tenants/acme/notes`. - GET `/memory` and `/debug/logs` without a key. For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry