Lab 01 — Security Portfolio Evidence Linter

Difficulty: 3/5 | Runs locally: yes

Pairs with the Phase 12 WARMUP Chapters 3, 8 (the defensible finding, the portfolio as evidence) and the HITCHHIKERS-GUIDE ("Artifact Review Gate").

Why This Lab Exists (Purpose & Goal)

The technical phases made you capable; this phase makes you credible. A portfolio of security work is how you prove that capability to a hiring committee, a client, or a team you're trying to influence — but a portfolio of half-finished, unverifiable, or secret-leaking artifacts does the opposite. The goal of this lab is to build the linter that automates the quality gate every flagship artifact must pass, so your portfolio demonstrates the discipline it documents.

The Concept, In the Weeds

A credible security artifact carries a specific set of evidence, and the linter checks for each:

authorization boundary · threat model · setup · tests · attack fixture · remediation · limitations · teardown · no secret canaries

Several of these encode hard-won lessons from earlier phases:

  • authorization boundary — every artifact states what it was authorized to do (Phase 00); a security artifact with no scope statement is a red flag.
  • threat model + remediation + limitations — it's not a finding unless it models the threat, fixes it, and honestly states what it doesn't cover.
  • tests + attack fixture — claims must be backed by something that runs (the requirement → control → test discipline).
  • no secret canaries — a portfolio that leaks a credential is an own-goal; the linter scans for it (Phase 03 secret scanning).

The lab also enforces lab-vs-production honesty: claiming production experience from a lab is both dishonest and trivially exposed in an interview. The linter is itself a demonstration — a portfolio quality gate that practices the engineering it preaches.

Why This Matters for Protecting the Company (and Your Career)

Your ability to protect the company depends on your ability to influence it — to get engineers to fix things and executives to fund things — and influence is built on credibility. A portfolio that is curated, reproducible, honest about limitations, and free of leaked secrets is what earns you the trust to be handed real scope. Conversely, an artifact that leaks a secret or overclaims is a liability that follows you. At the program level, the same evidence standard applies to every deliverable your team produces — findings, reviews, runbooks — so building the discipline to gate artifacts on evidence is directly how a security function maintains the credibility it needs to function.

Build It

Implement the linter: scan project metadata for authorization boundary, threat model, setup, tests, attack fixture, remediation, limitations, teardown, and absence of obvious secret canaries. It's a quality gate, not a substitute for human review.

LAB_MODULE=solution pytest -q

Validation — What You Should Be Able to Do Now

  • Define the evidence a credible security artifact must contain and automate the check.
  • Apply lab-vs-production honesty and explain why an inflated claim collapses under interview scrutiny.
  • Curate signal over volume — a tight set of deep, defensible artifacts beats a sprawling one.

The Broader Perspective

This lab teaches that credibility is engineered, not asserted — through reproducibility, honesty about limitations, traceable claims, and the absence of own-goals like leaked secrets. That standard is the same one you'll hold your team's findings, reports, and runbooks to, and it's the foundation of the trust that lets a security engineer actually change what an organization does. The deeper habit — treat your own output with the same rigor you demand of the systems you review — is what separates engineers who are listened to from those who are politely ignored. Your portfolio is the first system a future employer will security-review; make it pass.

Interview Angle

  • "How do you know a security artifact is portfolio-ready?" — It runs/renders from a clean checkout, states authorization, contains a threat model, includes tests/evidence, shows remediation, discloses limitations, has no leaked secrets, and every claim is honestly scoped (lab vs production) and traces to evidence.

Extension (Stretch)

Wire the linter into CI for your portfolio repo (markdown lint + link check + secret scan), and run it across all 6–8 flagship artifacts before publishing.

References