This repository documents a personal, isolated home lab used for learning Blue Team, SIEM, and detection engineering concepts. It is not a production system, service, or piece of software that accepts external users, traffic, or contributions of running code. There is no live, internet-facing instance of this lab tied to this repository.

Because of that, the usual "report a vulnerability in our product" process does not really apply here. This document instead covers what is and isn't in scope, and how the repository content itself is kept safe to publish.

To keep this project safe to share publicly, the repository does not include:

• Real credentials, API keys, or license keys
• Real IP addresses, hostnames, or network details beyond the lab's private 192.168.56.0/24 range
• Personally identifiable information
• Unredacted screenshots showing host machine details, personal accounts, or anything outside the isolated lab VMs
• Splunk .conf files containing anything other than lab-specific, non-sensitive settings

.gitignore explicitly excludes local-only files (*.conf.bak, local/passwd, VM disk images, .env, *.key) to reduce the chance of an accidental commit of sensitive material.

If you notice something in this repository that looks like it might be sensitive (e.g. an unredacted detail in a screenshot or config example), please open a GitHub issue describing the file and location, or contact the repository owner directly. Do not open a public issue that reproduces the sensitive content itself — just point to where it is.

All activity documented in this project (PowerShell test commands, registry modifications, simulated attacker actions from the Kali VM, etc.) was performed:

• Inside isolated VirtualBox virtual machines
• On a host-only network segment with no bridging to production networks
• Using test/lab accounts only, never production credentials

None of the techniques documented here were run against systems outside the lab, and none of the commands or configs in this repository are intended to be run outside a similarly isolated environment.

This is a personal learning project without a formal responsible-disclosure program or bug bounty. General good-faith security feedback about the repository content is always welcome via GitHub issues.