Themes the attack titles do not finish. Original miniatures.

Supply
  The app loads pay.py from a third-party build.
  Defense on the card: obtain the artifact through a trusted source, record its exact version, and compare a checksum with a trusted expected value. A checksum supplied beside a replaceable file is not an authenticity guarantee.
  This stage does not teach how to audit a registry.

Integrity of an artifact
  A saved object is loaded because the file name looks familiar.
  Defense on the card: load only a constrained data format and check its shape.
  The deserialization lesson continues this theme.

Logging
  A forbidden read returns and no operator record is written.
  Defense on the card: write the caller, the object, the decision, and the time, and alert on a burst of forbidden reads.
  The log must not contain the fictional secrets from the disclosure lesson.

Exception
  A public error includes a secret so that debugging is faster.
  Defense on the card: the public body keeps a safe message and reference id. Restricted diagnostics retain appropriate context but omit or redact secrets.