Your Repos Only

Your repos only means YOUR authorized Git repositories and lab apps under $DEVSEC_LAB — labeled courseware targets, self-authored repo inventory — document repo scope in notes before any scanner run.

Your Repos Only• Audio Walkthrough

00:00/03:43

Visual · t36_your_repos_only

Repo scope. $DEVSEC_LAB only. Original Cyberlium.

The repo owner is part of scope — Cyberlium refuses SAST, secrets, or DAST runs against stranger org codebases or apps you do not have authorization to test.

Your DevSec lab repos are Git remotes YOU operate — cyberlium-lab-app, cyberlium-lab-api, labeled courseware sample repos on example.local deploy targets. Scanners run on $DEVSEC_LAB only — never copied from live breach dumps or aimed at stranger cloud subscriptions. Cyberlium maps allowed repo inventory on YOUR $DEVSEC_LAB — repo name, default branch, lab app URL, fictional org label — never 'borrowed' employer production repos or scraped stranger GitHub orgs. Next: No Stranger Pipelines.

1. Allowed repo surfaces (named)

Self-authored lab repos with fictional org names. Courseware DevSec packs with explicit training labels. Isolated lab deploy URLs on example.local or localhost. Workflow files in YOUR GitHub fork or personal org only.

On $DEVSEC_LAB, list repo inventory row — repo name, default branch, lab app URL, fictional org label — never paste stranger org URLs from public lists.

Command guide

Try these commands — Allowed repo surfaces (named)

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why repo scope matters before scanners

SAST, secrets, and DAST tools are powerful on any codebase or URL. Scope is what keeps practice legal and ethical. Employer production repos, stranger GitHub orgs, and third-party live sites are out of scope.

If you cannot answer 'who owns this repo and is it labeled lab-only?', pause and fix scope notes before running the scanner.

3. Repo inventory habit

Forbidden: importing stranger org repos because they 'look like training.' Allowed: repo inventory row — name, branch, lab URL, source = $DEVSEC_LAB self-authored.

Ship: repo inventory row for three fictional lab repos. Next: No Stranger Pipelines.

4. What you ship: repo inventory row for $DEVSEC_LAB

Three fictional lab repos with URL labels. $DEVSEC_LAB named. NEVER stranger org repos. chmod 600.

5. What you record before the next lesson

Date. Repo inventory row. $DEVSEC_LAB named. File t36-m01-l02-your-repos-only.txt chmod 600.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Clone stranger org repo because lab repos are boring. Skip repo label because 'it's just a scan.'
Right: Write repo inventory row for YOUR $DEVSEC_LAB. Next: No Stranger Pipelines.

Hands-on Exercise