GITHUB ACTIONS
Security regression workflow
Run the fixture tests on pushes and pull requests. Read-only permissions; no deployment.
security.ymlTHE TEMPLATE SHELF
A useful place to start.
Small files that go with the labs. Read them here, download them, and adapt them to your project. Each one explains where it belongs.
FOUR FILES. NO SIGN-UP.Need the project too? Get the starter kit ↓
CONTAINER
A test-gated container build
Build the fixed app as a non-root user, with tests and a health check.
DockerfileWORKSHEET
A one-page threat model
Map the records API, ownership risk, and evidence for your control.
threat-model.txtRUNBOOK
Access-denial response
Practice validation, scope, containment, and recovery as a team.
incident-playbook.txtTeaching defaults are kept readable. Before using these in production, review image digests, action SHAs, permissions, and your own release requirements.