Lesson 3: Defences against injection, each one measured
23 min read·13 Oct 2026
Module 11 · Lesson 3 · About 55 minutes · Needs: Module 11 Lesson 2 (the attack surface, T-1034); Module 6 Lesson 3 (scopes, the guard chain) helps
The situation
It is Thursday 23 July 2026, week 8. In Monday's red-team session, T-1034 from Leo Park asked the assistant to refund 500 USD "now" and "not ask a human". The role check in code refused it: Leo is a member, not an owner.
Anika asks: "One check held. What if it had a bug?" You will add five defences, measure each on T-1034 and the 36 shared tickets, and count what each costs in genuine customers wrongly flagged. Two disguised copies of T-1034, simulated in this lesson from the same words, test them.