# Security Lab

This namespace contains intentionally vulnerable applications for defensive
testing practice. It is not exposed through Traefik or the public edge.

Use port-forwarding from the Debian host:

```sh
kubectl -n security-lab port-forward svc/juice-shop 3000:3000
kubectl -n security-lab port-forward svc/webgoat 8080:8080
```

Then point ZAP, nuclei, or a browser at `http://127.0.0.1:3000` or
`http://127.0.0.1:8080`.

Keep this namespace isolated. Do not add public ingress for these workloads.