- M1: add a no-git "Get the course materials" step (download+unzip; clone noted
as Module 8) so Part A's paths resolve without assuming git. URL flagged
Verify-before-publish (swap to public host before publishing).
- M15: security gate was failing OPEN on python3-only systems (bare `python`)
and missing the UNTRACKED config.py, so the planted secret passed green. Now
guards python3, fails CLOSED on any non-clean exit, and stages files so the
planted SYNC_API_KEY + typosquat dep are actually caught.
- M15: correct the false "Bandit flags the API key" claim (B105-107 need
password-named ids); add an honest MD5 (B324) flaw so the SAST demo fires.
Planted secret/deps preserved.
- M17: require the .env loader to use setdefault so Part D's override demo works;
explain precedence. Hardcoded "before" anti-pattern left intact.
Closes#6Closes#17Closes#18Closes#19Closes#29
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TfzV5QvtPDz8LJS3Pu5VLT
claude