How to Do & Submit Work

Platforms: the course platform (material, quizzes, arena) + GitHub (your code fixes). All offensive work is on the provided sandbox targets only — see ETHICS.md.

One-time setup (Week 1)

Every lab starts with cd labs/weekNN-…, so you need the repository on your own machine before Week 1. Nothing on the website will work without this step.

1. Create a GitHub account, then fork the course repo: <https://github.com/nutthakorn7/software-security>
2. Clone your fork and check it out:

   git clone https://github.com/<your-github-username>/software-security.git
   cd software-security

3. Stand up the environment (Docker Desktop, Burp/ZAP; a Linux VM is an optional fallback) — this is Week 1 Lab 0.
4. All the reading is at learn.zcr.ai — no sign-in needed. You do not need ctf.zcr.ai in Week 1, which has no flag; your arena account (username = your student ID) is issued before the first week that has an arena challenge.

Weekly LAB — how to do & submit

Do it:

1. In your fork, create a branch wk<NN> (e.g. wk04).
2. Stand up the week's target: docker compose up (or the command in that lab's README). Most web labs publish on port 8080, so run one lab at a time — before starting the next lab run docker compose down in the current lab's folder, or you'll get Bind for 127.0.0.1:8080 failed: port is already allocated. To run two at once, change only the middle number of the port mapping in that lab's docker-compose.yml (e.g. "127.0.0.1:8081:5000") and open http://localhost:8081. Keep the 127.0.0.1: in front — it keeps the deliberately vulnerable lab off the classroom network — and never change the right side (5000); the app listens on 5000 inside the container, and on macOS port 5000 is taken by AirPlay Receiver.
3. Work through the worksheet (labs/week<NN>…/worksheet.md): for each task record the payload/command, a screenshot of the result, and a 2–3 sentence mitigation.
4. For the Defend / fix task: edit the code, commit to your wk<NN> branch, and note the commit hash in the worksheet. Commit code only — keep the worksheet, screenshots and flags out of git.

Submit (two parts): | Part | Where | What | |------|-------|------| | Worksheet | learn.zcr.ai/submit | the completed worksheet exported to PDF (screenshots embedded). You can replace it any time before the deadline. | | Code fix | GitHub (your fork) | push branch wk<NN> to your fork and paste the commit link in the worksheet. The commit holds only the code you changed — no worksheet, screenshots or flags. Do not open a pull request: a PR from your fork goes to the public course repo. |

Your fork is public — anyone can read it. It holds your code fix and nothing else. The worksheet PDF and its screenshots go to learn.zcr.ai/submit only; an answer posted on GitHub before the deadline can be copied by anyone.

File name: Wk<NN>_<StudentID>.pdf (e.g. Wk04_65123456.pdf) Deadline: 23:59 (Thai time) the night before the next week's class — for KOSEN's Tuesday class that is Monday 23:59; the exact time is on learn.zcr.ai/submit. Grading: the 100-pt rubric in each worksheet (Lecture Qs 20 / Tasks+evidence 40 / Defense 25 / Reflection 15).

QUIZ — how it works

• On the course platform: go to learn.zcr.ai/quiz and enter the one-time code on your slip or in your email. It works once, for you only, and you cannot go back to a previous question once you continue.
• Weekly quiz: a short ~10-min quiz at the start of every teaching week (6 Q: 5 MCQ + 1 short, individual). Low-stakes — the lowest 1–2 are dropped.
• Cumulative review quizzes: two bigger 25-pt quizzes in the review weeks (W7 pre-midterm, W17 pre-final).
• No separate file to submit — finishing the quiz is the submission.

EXAMS

TERM PROJECT

• Report: fill project/REPORT-TEMPLATE.md → export PDF → learn.zcr.ai/submit.
• Code + SBOM + signed artifact + CI pipeline: in the team's GitHub repo (link in the report).
• Demo video: an unlisted YouTube or Google Drive link (viewable by anyone with the link) in the report's cover table, due with the report.
• Milestones per project/README.md.

Rules for every submission

• Name + Student ID on every file; teamwork only where stated (labs/quizzes/exams are individual).
• AI-tool disclosure: state how you used any AI tool (search, code, translate) — a section is built into the worksheet/report.
• Late (KOSEN): −10% of the item's score per started day late, reaching 0 after 10 days; the portal stops accepting work after day 10 (see syllabus.md §6). Submit what you have.
• Handed in on time = final at the deadline. After the deadline you can't change, replace or add to it, so one stray re-upload can never turn an on-time hand-in late.
• Late work: your last upload sets how late it is. Adding a file on day 5 makes the whole hand-in 5 days late. Each started 24 h after the deadline counts as a day, so 1 minute late is already −10%; after day 10 the worksheet closes.

Academic Integrity & Anti-Cheating

This is a security course — we practice the same rigor on your own work. The following controls are in place; assume your submission is checked.

• Your flags are unique to you. Each student receives personalized CTF/lab flags derived from your student ID. A flag is traceable to the person it was issued to — submitting someone else's flag is detected automatically and counts as a violation for both parties.
• Your screenshots must show you. Evidence must include a terminal running printf '%s | %s | ' "$(whoami)" '<YOUR-STUDENT-ID>'; date '+%F %T %Z' (on Windows, in Git Bash or WSL) in the same image as the evidence. When the evidence is a browser page, a DevTools panel or a rendered response, put that terminal beside the browser and capture the whole screen — a cropped window carries nothing that identifies you, and the lab's own output is byte-identical for the whole cohort by design, so the stamp is the only thing that makes the shot yours. Generic or borrowed screenshots are not accepted.
• Your code is attributable. Work in your own GitHub fork with your own commits. Submissions are run through code-similarity tools (MOSS/JPlag) against classmates and previous cohorts. A single "paste-everything" commit with no history is a red flag.
• Quizzes are individual, time-limited and one attempt — your access code is single-use and tied to you. Question order and option order are shuffled per-student, and the quiz only moves forward, so no two people see the same paper and nobody can revisit an earlier question.
• Random live checks. You may be asked to reproduce a task or explain your fix live. Answers you can't explain in your own words score zero.
• Explain, don't copy. Reflection questions are graded on your reasoning about your results.

Allowed: discussing concepts, helping a classmate debug their own setup, using AI tools if disclosed. Not allowed: sharing flags/answers/code, submitting another's screenshots, copying a report.

Violations follow the ethics & academic-integrity policy and KOSEN's conduct process.