Labs
Hands-on, opinionated security playgrounds. Each lab pairs a working demo with the failure modes I've actually seen in production. Built because the topics here don't survive PowerPoint.
Identity Lab
Phishing-resistant authentication, end to end. Register a passkey in your browser, decode real JWTs and see what makes them forgeable, and learn how the same primitives apply to AI agents acting on a user's behalf.
- WebAuthn / passkey registration + sign-in
- JWT inspector with 8 alg-confusion / PII findings
- Phishing-resistant MFA explainer
- Agent identity (OIDC, SPIFFE, RFC 8693)
CSP Playground
Paste a Content-Security-Policy header, watch the analyzer flag the same patterns I flag in client engagements: unsafe-inline, wildcards, missing object-src, no nonce, no report-uri. Then see the four canonical CSP shapes side by side.
- Live CSP header analyzer (12 rules)
- Four canonical policy shapes compared
- Common bypass patterns (JSONP, base-uri, dangling markup)
- Migration path from unsafe-inline to nonces
Prompt Injection Lab
Indirect prompt injection, tool-call hijacking, exfiltration via markdown images. A deterministic side-by-side simulator of a naive vs hardened agent on identical attacker-crafted documents. No LLM API key required.
- Naive vs hardened agent simulator (6 samples)
- 10-rule injection detector (PI01–PI10)
- Defense playbook ranked by impact
- Pairs with the agent identity work in Identity Lab
SSRF / Cloud Metadata
Why 169.254.169.254 is the most-attacked IP on the internet. URL analyzer that decodes decimal, hex, octal, and alias-hostname bypasses; a tour of the five canonical SSRF targets; and the four hardening layers ranked by impact.
- URL bypass analyzer (8 sample payloads)
- AWS IMDS, GCP, Azure, Redis, Kubernetes targets
- IMDSv2, egress firewall, SSRF-safe URL validation
- Identity-layer scoping for blast-radius control
Why labs
Every security finding I've ever written has been more convincing when the reader could touch the bug. Slide decks let people nod along; a working demo, with the actual headers on the actual wire, is what changes architecture decisions.
These labs cost nothing to run, are linkable in a code review, and each one is a complete teaching artifact in under five minutes. If you're an engineer trying to convince a leader, or a leader trying to understand an engineer, that's what they're for.
Source
Everything is open source under MIT. github.com/mdiallo15/identity-lab. Issues and PRs welcome.