This repository contains educational code: labs, projects, the mock-exam engine and repository tooling. Please report:

• a vulnerability in that code (for example, unsafe handling of model output, injection paths or path traversal),
• an accidentally committed secret or credential,
• example code that teaches an insecure pattern without flagging it,
• a dependency with a known vulnerability.

Out of scope: vulnerabilities in Anthropic products (Claude, the API, Claude Code). Report those to Anthropic through its responsible disclosure policy.

Please do not open a public issue for a security problem. Use GitHub's private vulnerability reporting from the repository's Security tab. Include:

• the affected file(s) and line(s),
• the impact and how to reproduce it,
• a suggested fix, if you have one.

You should receive an acknowledgement within 7 days. Fixes for confirmed issues are prioritised, and reporters are credited in the CHANGELOG unless they prefer otherwise.

Report it privately as above. If it is yours, revoke it immediately in the issuing console (for an Anthropic API key, the Claude Console), because a key that has reached a public repository must be treated as compromised even after it is removed from history.

• No real credentials: configuration uses environment variables and .env.example placeholders.
• CI runs gitleaks and tools/scan_secrets.py on every push and pull request.
• Labs default to offline mock mode, so CI never calls a live API.
• Model output is treated as untrusted input throughout the examples.
• The browser mock exam uses a strict Content Security Policy and renders all content as text.

Only the main branch is maintained.