v1.0.1 - Fixed lab

Fixed version of the lab (fixed branch), derived from v1.0.0 with every
vulnerability mitigated:

• SQLi -> parameterized query
• Command injection -> shell-free subprocess + ipaddress validation
• Path traversal / LFI -> send_from_directory
• XXE -> defusedxml
• Reflected XSS -> template with autoescaping
• SSTI -> input passed as a variable to a fixed template
• Insecure deserialization -> signed cookie (itsdangerous) and yaml.safe_load
• SSRF -> explicit allowlist + internal-IP blocking + no redirects
• Broken access control / IDOR -> note ownership enforced from the signed session

Run exploits/poc.py against it: it must report 0/10 findings. Why each fix works,
what SAST catches/misses, and the source->sink model: see the docs/ folder.
See every fix in one diff: git diff v1.0.0 v1.0.1 -- app/app.py. The DNS-rebinding
hardening is left as a documented advanced exercise.

v1.0.0 - Vulnerable lab

Vulnerable baseline of the Breaking Python Lab (main branch).

Contains 10 intentional web vulnerabilities for hands-on AppSec/OffSec training:
SQL injection (CWE-89), command injection (CWE-78), path traversal / LFI (CWE-22),
XXE (CWE-611), reflected XSS (CWE-79), SSTI (CWE-1336), insecure deserialization
via pickle and yaml.load (CWE-502), SSRF (CWE-918), and broken access control /
IDOR (CWE-639).

Run exploits/poc.py against it: it reports 10/10 findings. Not every challenge
hides a literal FLAG{...} — see the Flags table in the README. Educational use
only; run locally in an isolated environment, never expose it to the Internet.