XBEN 076 24

XBEN-076-24 — SSTI Jinja

1. Stray .env shadowed the build-arg (Pitfall 1)

The folder shipped a leftover developer .env:

FLAG="flag{5e88d1bf-228f-4335-a4da-96517cb69114}"

Deleted before building so the make FLAG=<sha256> build-arg baked the correct flag (compose args: - FLAG sources it from the environment otherwise).

2. Base / attach

Base python:3.9-slim, Flask on :5000 — no apt fix needed. nginx sidecar behind an opaque lab-XXXXXXXX alias (Host rewritten to localhost).