Your Repo Only

Your code lives in $MY_REPO on YOUR machine — never stranger SaaS or live shop targets.

Your Repo Only• Audio Walkthrough

00:00/03:53

Visual · secure_coding_your_repo_only

Lab repo you control. Repo = $MY_REPO. Original Cyberlium.

Fuzzing a classmate's deploy is everyone else's problem. YOUR repo keeps secure coding where it belongs.

RoE named the repo. This lesson names the asset boundary. A secure-coding lab belongs in a git repository you created — isolated from roommates' side projects, employer production, and café ordering sites. $MY_REPO is the name of that codebase — not a trending SaaS login, not a live shop checkout. You verify you are in $MY_REPO before any scanner or test harness runs. You do NOT sqlmap dorm project URLs for 'validation practice,' do NOT XSS live e-commerce reviews, do NOT OAuth-phish classmates. Next: RoE Lab.

1. Your repo means you control the commits

A lab repo can be a fresh git init with a toy REST API or static site — as long as YOU own the remote and strangers do not depend on it for production commerce. Document language, framework, and who may push.

If you cannot find $MY_REPO locally, clone your lab template — do not 'fix' it by testing someone else's deployed app.

Command guide

Try these commands — Your repo means you control the commits

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ CWE — https://cwe.mitre.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3
sudo apt install curl

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)

═══ LINUX / macOS ═══

Command — copy this

mkdir -p "$HOME/cyberlium-lab/t17-toy"
printf '%s
' 'from http.server import BaseHTTPRequestHandler, HTTPServer' 'class H(BaseHTTPRequestHandler):' '  def do_GET(self):' '    self.send_response(200); self.end_headers(); self.wfile.write(b"ok")' 'HTTPServer(("127.0.0.1",8820), H).serve_forever()' > "$HOME/cyberlium-lab/t17-toy/server.py"
python3 -m py_compile "$HOME/cyberlium-lab/t17-toy/server.py"
curl -sS --max-time 1 http://127.0.0.1:8820/ || echo 'Start: python3 ~/cyberlium-lab/t17-toy/server.py then curl again'

Primary tools to practice this lesson: python3, curl. Reference sites: OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); CWE (https://cwe.mitre.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Disposable toy app, real consequences elsewhere

Branch or reset the lab repo between exercises. A toy app is cattle: revert bad commits, reapply secure patterns, continue literacy.

Injection tests, DAST, or credential experiments on employer production, school servers, or live shops are out of scope forever in Cyberlium secure-coding modules.

3. Developer mirror

Secure teams inventory owned repos the same way: know your deploy targets, gate CI on owned code, never trust 'helpful' scans from strangers. Your lab is a miniature of that discipline.

Ship one line: repo=$MY_REPO, scope=owned only, never=stranger SaaS/live shops.

4. What you ship: repo boundary rule

Document $MY_REPO you control. Refuse stranger deploy URLs. No live shop testing. chmod 600 note.

5. What you record before the next lesson

Date. Language/framework. $MY_REPO path proof. NEVER stranger SaaS, live shops, classmate deploys. File t17-m01-l03-your-repo-only.txt chmod 600.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: sqlmap every login form on a hackathon demo day. XSS a live shop product review 'to learn encoding.'
Right: Write repo boundary rule and $MY_REPO. Next: RoE Lab.

Hands-on Exercise

Mission: prove repo isolation before tools

1) Document your lab language/framework and path to $MY_REPO. 2) Record how you verify you are in the right repo before changes. 3) Local dev only — not neighbor deploy URLs. Never test exploits on stranger apps.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

If $MY_REPO is missing, ask Mentor about lab template setup — not how to fuzz a live shop.

Practice QuizQuestion 1

Multiple choice

APPLY: Best target for secure-coding labs in this course:

Practice QuizQuestion 2

True or False

APPLY: True or False: sqlmap on classmate deploy URLs is acceptable secure-coding prep when bored.

Practice QuizQuestion 3

Multiple choice

APPLY: $MY_REPO in Cyberlium means: