Reduced bold text

Author: olivomarco

modules/README.md

@@ -1,6 +1,6 @@
 # Modules
 
-This directory contains the **source content** for each delivery session module. The build script (`docs/build.js`) reads from here — never from `docs/` directly.
+This directory contains the source content for each delivery session module. The build script (`docs/build.js`) reads from here — never from `docs/` directly.
 
 ## Layout
 

modules/_TEMPLATE/challenge/COACH.md

@@ -1,6 +1,6 @@
 # Delivery Assurance Guide — Work Package Title
 
-> **For delivery leads only.** This guide contains expected evidence, risk controls, and progressive support. Do not share with customer delivery team members before they attempt the work package.
+> For delivery leads only. This guide contains expected evidence, risk controls, and progressive support. Do not share with customer delivery team members before they attempt the work package.
 
 ## Delivery intent
 
@@ -13,7 +13,7 @@ REPLACE: One paragraph on the customer outcome, approved change boundary, eviden
 | Scope, ownership, and approval | ~10 min |
 | Implementation and evidence | ~40 min |
 | Assurance, handover, and next action | ~10 min |
-| **Total** | ~60 min |
+| Total | ~60 min |
 
 ## Expected evidence
 
@@ -26,20 +26,20 @@ At the end of this work package, verify:
 ## Delivery risks and recovery
 
 ### REPLACE: Pitfall title
-**Symptom:** REPLACE  
-**Fix:** REPLACE
+Symptom: REPLACE  
+Fix: REPLACE
 
 ### REPLACE: Another pitfall
-**Symptom:** REPLACE  
-**Fix:** REPLACE
+Symptom: REPLACE  
+Fix: REPLACE
 
 ## Progressive support
 
 Use these in order. Preserve customer ownership: give the first prompt, wait, then increase specificity only if the delivery team is blocked.
 
-1. **Hint 1 (gentle):** REPLACE — a nudge in the right direction without revealing the answer.
-2. **Hint 2 (medium):** REPLACE — more specific guidance.
-3. **Hint 3 (specific):** REPLACE — points almost directly to the solution.
+1. Hint 1 (gentle): REPLACE — a nudge in the right direction without revealing the answer.
+2. Hint 2 (medium): REPLACE — more specific guidance.
+3. Hint 3 (specific): REPLACE — points almost directly to the solution.
 
 ## Handover questions
 

modules/_TEMPLATE/challenge/README.md

@@ -1,16 +1,16 @@
 # Delivery Work Package Title
 
-> **Module:** REPLACE | **Track:** REPLACE | **Complexity:** beginner | **Delivery time:** ~60 min
+> Module: REPLACE | Track: REPLACE | Complexity: beginner | Delivery time: ~60 min
 
 ## Customer outcome
 
 REPLACE: One sentence describing the customer-owned capability, guardrail, or workflow this work package will establish.
 
 ## Prerequisites
 
-**Prior work packages:** _(none — this work package is self-contained)_
+Prior work packages: _(none — this work package is self-contained)_
 
-**Delivery readiness:**
+Delivery readiness:
 - GitHub account with organization access
 - Basic Git knowledge
 - Customer owner approval for the intended tenant change, where applicable

modules/ghas/challenges/00-environment-setup/COACH.md

@@ -14,15 +14,15 @@
 
 ## Facilitation Hints
 
-- **Push Codespaces first.** If local setup consumes more than 10 minutes, redirect to Codespaces.
+- Push Codespaces first. If local setup consumes more than 10 minutes, redirect to Codespaces.
 - Start with the GHAS configuration and ownership record. Ask which real repository or service is in scope, why its criticality matters, and whether Juice Shop is only the fallback practice target.
 - Ask for a show-of-hands check after the first 10 minutes: successful commands and a completed record with named owners.
 - Pair any blocked participant with a working neighbor; one blocker should not stall the group.
 - Start by having the responsible participant, team lead, or organizer run:
   `./setup.sh provision ghas-00 --org <org>` or `./setup.ps1 provision ghas-00 -Org <org>`.
-- Verify that **Codespaces is enabled for the org** before the event starts (org Settings → Codespaces → Allow for all members). If not enabled, participants see no Codespace option.
+- Verify that Codespaces is enabled for the org before the event starts (org Settings → Codespaces → Allow for all members). If not enabled, participants see no Codespace option.
 - If Copilot is not yet licensed for all participants, pair them so every team still practices the Copilot-assisted review loop in S01–S06.
-- Confirm **GHAS is enabled** on the provisioned org repo (Settings → Code security and analysis). CodeQL, secret scanning, Dependabot alerts, and push protection must all be on — S01–S06 depend on them.
+- Confirm GHAS is enabled on the provisioned org repo (Settings → Code security and analysis). CodeQL, secret scanning, Dependabot alerts, and push protection must all be on — S01–S06 depend on them.
 - Confirm the repository access list includes every participant or team that needs to push a branch. The script creates/configures the repo; it does not guess workshop roster membership.
 - Do not accept a feature toggle or a running storefront as completion by itself. Validate that enabled and missing GHAS capabilities, accountable roles, agentic delivery principles, and blocker ownership and dates are recorded in the baseline.
 - When discussing agentic delivery, keep the scope to the documented principles: least privilege; humans remain accountable for approval and merge; and agent-originated changes receive normal GHAS and PR validation.
@@ -65,13 +65,13 @@ delivery team:
 
 If a participant cannot reach the full environment, apply the smallest unblock:
 
-1. **Codespaces quota:** Use a local clone with Node.js installed, or request org Codespaces billing before the event.
-2. **Org access:** Coach adds participant to the repo or org team, or provides a pre-cloned repo baseline branch via `git bundle`.
-3. **Juice Shop unavailable (Docker blocked locally, Codespace quota exhausted):**
+1. Codespaces quota: Use a local clone with Node.js installed, or request org Codespaces billing before the event.
+2. Org access: Coach adds participant to the repo or org team, or provides a pre-cloned repo baseline branch via `git bundle`.
+3. Juice Shop unavailable (Docker blocked locally, Codespace quota exhausted):
    - Participants can still complete S01–S06 review steps by reading the pre-populated alert corpus in the Security tab — no live app required for the code-review loop.
-   - Coach provides a **pre-scanned results packet**: export of CodeQL SARIF results + Dependabot alert JSON + secret scanning summary so participants can proceed with the analysis tasks even without a running app.
+   - Coach provides a pre-scanned results packet: export of CodeQL SARIF results + Dependabot alert JSON + secret scanning summary so participants can proceed with the analysis tasks even without a running app.
    - For fixes: participants write and submit PRs; CodeQL runs on the PR branch in GitHub Actions and validates the fix without needing a local running instance.
-4. **GitHub Actions / CodeQL not running:** Coach triggers a manual workflow run (`gh workflow run codeql.yml`) or shares pre-generated SARIF results for the alert-reading portion.
+4. GitHub Actions / CodeQL not running: Coach triggers a manual workflow run (`gh workflow run codeql.yml`) or shares pre-generated SARIF results for the alert-reading portion.
 
 ## Useful references for coaching
 

modules/ghas/challenges/00-environment-setup/README.md

@@ -28,7 +28,7 @@ By the end of this activity, the delivery team will have:
 - GitHub Advanced Security available for the repository visibility you choose
 - GitHub Copilot license assigned
 
-> **Own-org workflow:** Do not rely on a preconfigured Microsoft or instructor repo.
+> Own-org workflow: Do not rely on a preconfigured Microsoft or instructor repo.
 > A participant, team lead, or organizer pushes Juice Shop into an org they control,
 > enables GHAS features there, then manually adds any participants or teams that need
 > repo access.
@@ -90,15 +90,15 @@ The default repository name is:
 
 If a feature cannot be enabled by automation because the org lacks the license or the
 authenticated user lacks permission, the script prints a warning. In that case, an org
-owner or repo admin must enable it manually in **Settings → Code security and analysis**.
+owner or repo admin must enable it manually in Settings → Code security and analysis.
 
 After provisioning, manually add any participants who need access:
 
 1. Open `https://github.com/<your-org>/ghec-ghas-00-juice-shop/settings/access`.
 2. Add the participant, team, or outside collaborator with the access level your event needs.
 3. Ask each participant to clone this org repo directly and work on a personal or team branch.
 
-> **Branch workflow (not fork):** This module uses the org repo you just created. Do **not** fork.
+> Branch workflow (not fork): This module uses the org repo you just created. Do not fork.
 > Clone directly and work on a personal branch. Use `team-{your-team-name}/challenge-work`
 > for teams, or `participant/{your-name}` for individual participants.
 
@@ -109,9 +109,9 @@ After provisioning, manually add any participants who need access:
 The fastest path — nothing to install locally.
 
 1. Open the org repository created above on github.com.
-2. Click **Code → Codespaces → Create codespace on main**.
+2. Click Code → Codespaces → Create codespace on main.
 3. Wait ~30–60 seconds for the dev container to build and dependencies to install.
-4. When the terminal appears, continue to **Create your branch** below.
+4. When the terminal appears, continue to Create your branch below.
 
 ---
 
@@ -120,7 +120,7 @@ The fastest path — nothing to install locally.
 If you prefer working locally, use Git and Node.js directly.
 
 1. Install [Git](https://git-scm.com/), [GitHub CLI](https://cli.github.com/), and Node.js 20 or later.
-2. Clone the org repo (do **not** fork it):
+2. Clone the org repo (do not fork it):
    ```bash
    git clone https://github.com/<your-org>/ghec-ghas-00-juice-shop.git
    cd ghec-ghas-00-juice-shop
@@ -137,7 +137,7 @@ Your container does not have your GitHub credentials pre-loaded. Run:
 gh auth login
 ```
 
-Choose **HTTPS**, follow the device-code prompt in your browser, and grant the requested
+Choose HTTPS, follow the device-code prompt in your browser, and grant the requested
 permissions.
 
 Verify:
@@ -164,15 +164,15 @@ git push -u origin participant/{your-github-handle}
 
 ## Start Juice Shop (Local Runtime)
 
-All GHAS activities work with OWASP Juice Shop for **manual exploit testing**. Because the setup script imports Juice Shop into your org repo, run the app from the repository root:
+All GHAS activities work with OWASP Juice Shop for manual exploit testing. Because the setup script imports Juice Shop into your org repo, run the app from the repository root:
 
 ```bash
 npm install
 npm start
 ```
 
-Juice Shop will be available at **port 3000**. In Codespaces, GitHub automatically
-port-forwards it — click the **Ports** tab and open the forwarded URL. Locally, open
+Juice Shop will be available at port 3000. In Codespaces, GitHub automatically
+port-forwards it — click the Ports tab and open the forwarded URL. Locally, open
 `http://localhost:3000` in your browser.
 
 Confirm you see the Juice Shop storefront before moving on.
@@ -181,9 +181,9 @@ Confirm you see the Juice Shop storefront before moving on.
 
 ## Important: GHAS Alerts vs. Local Runtime
 
-**Your local Juice Shop instance** is for manual testing and learning the app — it has **no GHAS alerts**. 
+Your local Juice Shop instance is for manual testing and learning the app — it has no GHAS alerts. 
 
-**GHAS alerts** (CodeQL, Dependabot, secret scanning) run on the **org repository you provisioned in this activity**. All activities reference alerts from that repo, not your local Juice Shop runtime.
+GHAS alerts (CodeQL, Dependabot, secret scanning) run on the org repository you provisioned in this activity. All activities reference alerts from that repo, not your local Juice Shop runtime.
 
 See [`modules/ghas/setup.md`](../../setup.md) for details on how these two environments work together.
 
@@ -214,7 +214,7 @@ Juice Shop homepage loads.
 > Successful commands alone do not complete this activity. Before moving on, confirm the
 > GHAS configuration and ownership record names the target and criticality, captures GHAS capability status
 > and accountable roles, records the agentic delivery principles, and assigns every
-> access or licensing blocker an owner and target date. See **Common Blockers** in the
+> access or licensing blocker an owner and target date. See Common Blockers in the
 > coach guide when setup cannot yet be completed.
 
 ## Success Criteria

modules/ghas/challenges/01-explore-attack-surface/COACH.md

@@ -4,9 +4,9 @@
 
 ## Required coach check-in
 
-**Required coach check-in:** before completion, ask the customer practitioner to connect the exercise to work they actually own.
+Required coach check-in: before completion, ask the customer practitioner to connect the exercise to work they actually own.
 
-**Their question:** Coach conversation — which inventory item creates the most important
+Their question: Coach conversation — which inventory item creates the most important
 business or security risk for the real project, who is accountable for it, and what
 should its next action and target date be?
 

modules/ghas/challenges/01-explore-attack-surface/README.md

@@ -10,26 +10,26 @@ This is your reconnaissance phase. Turn the alerts into an owned security-debt
 findings register that the delivery team can operate after the session, rather than a
 temporary mental model.
 
-> **Before this activity:** Make sure S00 is complete, the org repo exists, required participants have been added, GHAS features are enabled, and you've created your team branch. The Security tab is default-branch oriented. Your branch fixes will be validated later through PR CodeQL checks and code scanning annotations.
+> Before this activity: Make sure S00 is complete, the org repo exists, required participants have been added, GHAS features are enabled, and you've created your team branch. The Security tab is default-branch oriented. Your branch fixes will be validated later through PR CodeQL checks and code scanning annotations.
 
 ## Objectives
 
 - Use your own application repository or service first; use the Juice Shop fallback only when no suitable delivery target is available
-- Navigate to the relevant GHAS alerts, including **Security → Code scanning alerts**, and review the open default-branch alerts
+- Navigate to the relevant GHAS alerts, including Security → Code scanning alerts, and review the open default-branch alerts
 - Review at least 5 alerts in full — location, description, and the code path that triggers each finding
 - For each reviewed alert, open the affected file in your editor, ask Copilot Chat: *"What does this code do wrong, and how could an attacker exploit it?"*, and verify the explanation against the alert and code path
 - Create a security findings register with named owners in `modules/ghas/resources/ghas-governance-practice.template.md`
 - For every inventory item, record the alert category or class, affected repository, service, or component, business or security impact, remediation route, accountable owner or team, target date, current disposition (open, in progress, or accepted risk), and prioritization rationale
 - Use the five alert reviews as evidence supporting the inventory and its prioritization
-- Check **Security → Dependabot alerts** and record any critical or high-severity dependency vulnerabilities in the inventory
+- Check Security → Dependabot alerts and record any critical or high-severity dependency vulnerabilities in the inventory
 
 > [!IMPORTANT]
-> **Bring your own application (do this first)**
+> Bring your own application (do this first)
 >
 > This activity is most valuable when the attack-surface picture *outlives the delivery session*. Use a real application repository you want to secure so the CodeQL, Dependabot, and secret scanning results you review become evidence your team can keep acting on after today.
 >
-> - **Have a candidate?** If you have an application repo in an organization you control with GHAS enabled, use it everywhere this guide references Juice Shop or `ghec-ghas-00-juice-shop`. Skip the Juice-Shop-specific setup from S00 and review the Security tab for your own repo instead.
-> - **No suitable one?** Use the fallback from S00: OWASP Juice Shop as a safe practice target for learning how to inspect alerts.
+> - Have a candidate? If you have an application repo in an organization you control with GHAS enabled, use it everywhere this guide references Juice Shop or `ghec-ghas-00-juice-shop`. Skip the Juice-Shop-specific setup from S00 and review the Security tab for your own repo instead.
+> - No suitable one? Use the fallback from S00: OWASP Juice Shop as a safe practice target for learning how to inspect alerts.
 >
 > Tell your coach which path you took — bringing your own is the goal; Juice Shop is the fallback.
 >

modules/ghas/challenges/02-fix-injection/COACH.md

@@ -4,9 +4,9 @@
 
 ## Required coach check-in
 
-**Required coach check-in:** before completion, ask the delivery team member to connect the work to a service and review practice they own.
+Required coach check-in: before completion, ask the delivery team member to connect the work to a service and review practice they own.
 
-**Their question:** Coach conversation — where in your own codebase is user-controlled input most likely reaching a database query without parameterization, and what data could an attacker extract or modify if they found that path before your team did? Talk it through with your coach and connect it to a real project, task, or workflow you own.
+Their question: Coach conversation — where in your own codebase is user-controlled input most likely reaching a database query without parameterization, and what data could an attacker extract or modify if they found that path before your team did? Talk it through with your coach and connect it to a real project, task, or workflow you own.
 
 Use these follow-ups to steer the conversation:
 - Name a specific API endpoint or query in your own codebase where dynamic data flows into a database call — how confident are you that it uses parameterization, and when did you last verify it?