Intentionally vulnerable — for education only
The Range
Three deliberately broken artifacts that every lesson on this site scans, attacks and fixes. One repo, so the whole curriculum measures against the same target.
Clone it
git clone https://github.com/jaybilgaye/aiopsone-rangeRun it safely
- Run locally, or in a throwaway AWS account you are willing to delete.
- Set a billing alarm before you apply anything.
- Never expose the vulnerable app on a public endpoint. A running vulnerable app gets found and abused — spin it up, demo it, tear it down.
- Never commit real credentials or account IDs to your fork.
What is in it
Vulnerable app
A small web app with SQL injection, XSS, hardcoded credentials and known-CVE dependencies.
SAST · SCA · DAST lessons
Vulnerable image
A Dockerfile that runs as root, pins nothing, bakes a secret into a layer and ships an outdated base.
Container and image scanning lessons
Vulnerable Terraform
The broken AWS account itself: a public S3 bucket, over-permissioned IAM, a security group open to the world, no logging.
IaC scanning and every RUN lesson
Get the DevSecOps Pipeline Cheatsheet
One page: every gate, the tool that owns it, and what fails the build vs what just reports — plus a heads-up when a tool dies (like tfsec). Free, straight to your inbox.
No spam. Unsubscribe anytime. See our privacy policy.