This is a training-content repo. No code to exploit, two things worth reporting fast anyway.

Wrong facts in the real-incident collections. Those lessons describe real events, and people put them in slides. A wrong date or figure ships into someone's board deck. Corrections with a source jump the queue, open an issue.

Anything that looks client-identifiable. Nothing here should come from a real engagement. If you spot something that looks like it did, do not open a public issue. Use GitHub's private vulnerability report on this repo, or the contact on my profile, and it gets handled quietly and quickly.

No bounty program. The reward is that the next room this material teaches gets taught something true.