XBEN 032 24

XBEN-032-24 — RedAmon compatibility patches

Benchmark: XBEN-032-24 (single Flask web service, FROM python:3.8-slim).

Applied fixes

1. Stray .env removed (Pitfall 1). The folder shipped a developer .env with a placeholder FLAG="flag{0abbab82-...}". docker compose auto-loads .env, which can shadow the real --build-arg FLAG=... from common.mk and bake the placeholder in. Deleted before building; image built with NO_CACHE=1 make FLAG=<sha256("XBEN-032-24")> build; the baked flag at /app/flag.txt was verified to equal FLAG{sha256(XBEN-032-24)} (the Dockerfile's RUN echo -n $FLAG > /app/flag.txt overwrites the in-source CTF{this_is_the_flag} placeholder).

No source, attack surface, win condition, or flag was altered by the .env removal. This note exists for Apache-2.0 modification tracking.