Setup

Get your environment running

Two independent paths to the same two scenarios. Both were run end-to-end against this exact data before this guide was written, not just described.

Section 1 — Kali container, hand-picked skills

One Docker image with tools, Claude Code, and the 10 hand-picked skills baked in at docker build time — see fastlane/Dockerfile — instead of live-installing over docker exec. No pcap tooling needed here — this scenario's evidence is code, config, and logs, not network captures.

Prerequisites

• Docker (no local build needed — docker pull fetches the pre-built image from GHCR).
• A .env file in the fastlane/ folder (copied from casky-box/.env, quotes stripped — same fix as every other exercise, see Tailgate's Setup page for the exact sed command if you haven't done this before):

  cp ../casky-box/.env fastlane/.env
  sed -i.bak -E 's/^([A-Z_][A-Z0-9_]*)="(.*)"$/\1=\2/' fastlane/.env && rm fastlane/.env.bak

Steps

# Run every command below from THIS folder (casky-workshops/fastlane/).

# 0. Pull the pre-built image from GHCR (rebuilt nightly with the latest patches) instead
#    of building locally — much faster at a live session.
docker pull ghcr.io/casky-ai/casky-fastlane:latest
docker tag ghcr.io/casky-ai/casky-fastlane:latest casky-fastlane

# Fallback, kept for reference — tools, Claude Code, and the 10 skills are still baked
# into the image at build time (see Dockerfile); rebuild locally if you're iterating on
# the Dockerfile/skill list itself, or if GHCR is unreachable (offline/air-gapped venue):
#   docker build -t casky-fastlane .

docker run -d --name casky-fastlane \
  --env-file .env \
  -v "$(pwd)":/root/fastlane \
  casky-fastlane

docker exec casky-fastlane test -f /root/fastlane/verify.sh \
  && echo "[+] mount OK" || echo "[!] wrong directory — re-run from casky-workshops/fastlane/"

# 1. Run ./verify.sh — expect 12/12 PASS.
docker exec -w /root/fastlane casky-fastlane ./verify.sh

# 2. Bash into the container and start Claude Code interactively.
docker exec -it -w /root/fastlane casky-fastlane bash
#   ...now inside the container's shell:
export PATH="$HOME/.local/bin:$PATH"
./start.sh
claude

$ claude --print "Reply with exactly the single word: PONG"
PONG

== tooling ==
  ok      jq
  ok      grep
== gotcha 1/5 — RLS misconfiguration ==
  PASS  customers table: RLS disabled entirely (1)
  PASS  tickets table: RLS enabled but policy is USING (true) (1)
== gotcha 2/8 — secret exposure (same key, two leak paths) ==
  PASS  service-role key present across bundle/git-history/access-log (3)
== gotcha 3 — slopsquatting, caught pre-merge ==
  PASS  main branch package.json does NOT include the hallucinated package (0)
  PASS  the hallucinated package IS referenced in the unmerged PR branch (1)
== gotcha 4 — IDOR on /api/tickets/[id] ==
  PASS  sequential ticket-ID enumeration present in access log (5)
== gotcha 7 — CORS wildcard ==
  PASS  Access-Control-Allow-Origin: * present in next.config.js (1)
== gotcha 9 — exposed debug route ==
  PASS  unauthenticated hit on /api/debug/seed present in access log (2)
== gotcha 6 — dev-environment supply chain (MCP auto-trust) ==
  PASS  starter template's auto-trusted MCP config documented (1)
== gotcha 10 — general code scan ==
  PASS  general OWASP-flavored findings present (XSS, no rate-limit) (2)
== speedbump (proactive audit) ==
  PASS  correlation labels present across all 4 audit reports (8)
  PASS  slopsquatting finding correctly labeled not-exploited (matches pr-branch-diff.txt) (1)
----
RESULT: 12 passed, 0 failed
This laptop is READY.

[+] lab data present: app/ (FastLane) + speedbump/ (SpeedBump)
[+] agent skills mounted at /root/.claude/skills (10 skills)
[+] Claude Code found.
    mode: online (shared key)

Work FastLane or SpeedBump inside that interactive Claude Code session. exit the claude session and the container shell (two exits) between attendees, then run docker exec -w /root/fastlane casky-fastlane ./reset.sh.

Section 2 — Same scenarios, run on Casky Box

The same casky-runner container every exercise in this repo uses — all 818 skills mounted read-only, classifier picks the relevant ones automatically.

Prerequisites

cd ../casky-box    # casky-workshops/casky-box, shared by every workshop
cp .env.example .env   # first time only — then set ANTHROPIC_API_KEY
docker compose pull
docker compose up -d

Pulled from GHCR, no separate repo to clone — see casky-box/README.md for what's in it.

Steps

# Run every command below from THIS folder (casky-workshops/fastlane/).
cd /path/to/casky-workshops/fastlane
test -f app/rls-policies.json && echo "[+] correct folder" || echo "[!] cd to casky-workshops/fastlane first"

{
  echo "=== Gotcha 1/5 - Supabase RLS policy export ==="; cat app/rls-policies.json
  echo; echo "=== Gotcha 2 - Production client bundle excerpt (secret exposure) ==="; cat app/client-bundle-excerpt.txt
  echo; echo "=== Gotcha 3 - main branch package.json ==="; cat app/package.json
  echo; echo "=== Gotcha 3 - open PR branch diff (slopsquatting) ==="; cat app/pr-branch-diff.txt
  echo; echo "=== Gotcha 4 - /api/tickets/[id] route source (IDOR) ==="; cat app/api-tickets-route.js
  echo; echo "=== Breach evidence - access logs ==="; cat app/access-log.txt
  echo; echo "=== Gotcha 7 - next.config.js CORS headers ==="; cat app/next-config-cors.txt
  echo; echo "=== Gotcha 8 - git history env leak ==="; cat app/git-history-env-leak.txt
  echo; echo "=== Gotcha 6 - dev environment / MCP auto-trust audit ==="; cat app/dev-environment-audit.txt
  echo; echo "=== Gotcha 10 - general code scan summary ==="; cat app/code-scan-summary.txt
} > fastlane-full.txt

for f in speedbump/*.json; do echo "--- $(basename "$f") ---"; cat "$f"; echo; done > speedbump-full.txt

cp fastlane-full.txt speedbump-full.txt ../casky-box/evidence/
docker exec casky-runner ls /var/casky/evidence/

# Investigate — FastLane (reactive)
docker exec -it casky-runner casky harness --auto -i /var/casky/evidence/fastlane-full.txt

# Investigate — SpeedBump (proactive)
docker exec -it casky-runner casky harness --auto -i /var/casky/evidence/speedbump-full.txt

--auto runs every step's agent for real and produces a real, inspectable tool-call transcript per step ([VERIFIED] Skill script executed: YES/NO). Open casky-ui (http://localhost:8766) afterward for the Plan / Execution / Findings / Remediation tabs.

Done for the day, or resetting for the next attendee? See Cleanup on the Troubleshooting page.