RoE Written Scope
If it is not written, it is not in scope — draft YOUR secure-coding RoE for $MY_REPO.
Visual · secure_coding_roe_written_scope
RoE = written who / what / when / stop. $MY_REPO only. Original Cyberlium.
Curiosity is not authorization. A RoE file you chmod 600 is.
Rules of Engagement for secure-coding labs answer: which repo ($MY_REPO you control), which operator (you on your hardware), which actions (read code, add validation, run local tests per brief), where notes live ($HOME/cyberlium-lab), and stop conditions (any URL not localhost/$MY_REPO deploy, production stranger SaaS, live shop domains, classmate deploy links without their written OK). Original Cyberlium. You draft RoE before running scanners or injection tools. You do not copy a bug-bounty scope and aim it at a school project host. Next: Your Repo Only.
1. Four RoE lines: who, what, where, stop
Who: the repo owner (you) on code you control. What: read/review/harden $MY_REPO only per lab brief — local dev server, not stranger production. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: any hostname not localhost or your lab deploy, stranger SaaS URLs, live e-commerce domains, sqlmap/DAST against URLs you do not own.
Written scope is how you refuse 'test my startup login' in Discord. Their app needs their RoE — not your offensive tooling session.
Command guide
Try these commands — Four RoE lines: who, what, where, stop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP Developer Guide — https://owasp.org/www-project-developer-guide/ CWE — https://cwe.mitre.org/ (cite IDs in YOUR review notes)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab" cat > "$HOME/cyberlium-lab/t17-roe.txt" <<'EOF' MY_REPO=$HOME/cyberlium-lab/t17-toy TOY_APP=http://127.0.0.1:8820 never: sqlmap strangers, OAuth phishing, live shop testing EOF
Command — copy this
grep -i never "$HOME/cyberlium-lab/t17-roe.txt" openssl rand -hex 8 | head -c 16; echo ' # example lab token length — not a production secret'
Primary tools to practice this lesson: grep, openssl. Reference sites: OWASP Developer Guide (https://owasp.org/www-project-developer-guide/); CWE (https://cwe.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorization is not 'I found the repo on GitHub'
Public source code does not grant permission to attack a live deployment. Scope is repo-level: $MY_REPO and your local $TOY_APP instance are in; everything else is out until a signed engagement says otherwise — this course is not that engagement.
Professional developers attach security review to tickets and contracts. Steal the habit (write scope, respect stop) and leave stranger apps alone.
3. Stop conditions you can say out loud
If the target URL is not localhost or your lab deploy in the file, stop. If someone asks you to sqlmap their classmate's project, stop. If a tutorial DASTs a public shop domain, stop and rewrite to $MY_REPO.
Next lesson locks the repo boundary: YOUR git repo and toy app only, not bridged stranger SaaS.
4. What you ship: four written RoE lines for secure-coding work
who/what/where/stop on disk. $MY_REPO named. NEVER stranger SaaS, live shops, sqlmap on others' URLs. chmod 600.
5. What you record before the next lesson
Date. Four RoE lines. $MY_REPO named. File t17-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Keep RoE 'in your head.' sqlmap a dorm project's deploy URL because it is 'just practice.'
- Right: Write four lines and stop conditions. Next: Your Repo Only.
Mission: freeze secure-coding RoE before tools
1) Write who/what/where/stop in $HOME/cyberlium-lab. 2) Name $MY_REPO as the only in-scope repo. 3) List stop conditions including stranger SaaS and live shop domains. Never scan deploy URLs you do not own.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for a RoE template shape — not for a list of classmate deploy URLs to test.
APPLY: A classmate shares their startup API URL and says 'practice injection.' Your RoE lists only $MY_REPO. You:
APPLY: True or False: Public GitHub source grants permission to attack the author's live deployment.
APPLY: RoE 'stop' should include:
Your Repo Only
Part of Secure Coding with AI — Secure Coding Mindset and RoE.
RoE Lab
Part of Secure Coding with AI — Secure Coding Mindset and RoE.
Quiz — Secure Coding Mindset and RoE
Part of Secure Coding with AI — Secure Coding Mindset and RoE.