fix: update challenge titles and prerequisites for consistency across modules

Author: olivomarco

modules/ghas/challenges/s00-environment-setup/COACH.md

@@ -53,7 +53,7 @@ If a participant cannot reach the full environment, apply the smallest unblock:
 1. **Codespaces quota:** Use local dev container (VS Code + Docker Desktop), or request org Codespaces billing before the event.
 2. **Org access:** Coach adds participant to org team, or provides a pre-cloned repo baseline branch via `git bundle`.
 3. **Juice Shop unavailable (Docker blocked locally, Codespace quota exhausted):**
-   - Participants can still complete S01–S05 review steps by reading the pre-populated alert corpus in the Security tab — no live app required for the code-review loop.
+   - Participants can still complete S01–S06 review steps by reading the pre-populated alert corpus in the Security tab — no live app required for the code-review loop.
    - Coach provides a **pre-scanned results packet**: export of CodeQL SARIF results + Dependabot alert JSON + secret scanning summary so participants can proceed with the analysis tasks even without a running app.
    - For fixes: participants write and submit PRs; CodeQL runs on the PR branch in GitHub Actions and validates the fix without needing a local running instance.
 4. **GitHub Actions / CodeQL not running:** Coach triggers a manual workflow run (`gh workflow run codeql.yml`) or shares pre-generated SARIF results for the alert-reading portion.

modules/ghas/challenges/s00-environment-setup/README.md

@@ -93,7 +93,7 @@ All GHAS challenges work with OWASP Juice Shop for **manual exploit testing**. T
 ```bash
 npm run setup:juice-shop
 ```
-This command fetches Juice Shop at the exact pinned commit (`v20.0.0`), verifies the SHA, and links it to `app/` so the next command works immediately.
+This command fetches Juice Shop at the exact pinned release tag (`v20.0.0`), verifies the commit SHA, and links it to `app/` so the next command works immediately.
 
 **Step 2 — Start the app:**
 ```bash

modules/ghas/challenges/s01-explore-attack-surface/COACH.md

@@ -27,7 +27,7 @@ Use these follow-ups to steer the conversation:
 - Have students group alerts by class and likely remediation effort before they choose a fix order.
 - Ask them to explain one alert in plain language: what input is attacker-controlled, what sink is dangerous, and what impact follows.
 - If they rely too heavily on Copilot, ask them to verify the explanation against the actual code path.
-- Encourage notes they can reuse in S01-S05 so the reconnaissance work pays off later.
+- Encourage notes they can reuse in S02-S06 so the reconnaissance work pays off later.
 
 ## Validation checklist
 Verify each success criterion from the student guide:

modules/ghas/challenges/s01-explore-attack-surface/README.md

@@ -1,4 +1,4 @@
-# Challenge S-00: Explore the Attack Surface
+# Challenge S01 — Explore the Attack Surface
 
 ## Description
 

modules/ghas/challenges/s02-fix-injection/README.md

@@ -1,4 +1,4 @@
-# Challenge S-01: Fix Injection Vulnerabilities
+# Challenge S02 — Fix Injection Vulnerabilities
 
 ## Description
 
@@ -31,7 +31,7 @@ You're working as a developer fixing real application code. Not configuring tool
 - Ask: *"What's the difference between input sanitization and parameterization, and why is parameterization the right fix here?"*
 - Use Copilot Autofix in the Security tab — click an alert and hit **Generate fix** to see its proposed remediation, then review and refine it.
 
-**Power move:** If you've done C-00, create a custom Copilot agent that's instructed to always suggest parameterized queries when it sees raw string concatenation in SQL context.
+**Power move:** Create a custom Copilot agent (or repository custom instructions) that always suggests parameterized queries when it sees raw string concatenation in a SQL context.
 
 ## Learning Resources
 

modules/ghas/challenges/s02-fix-injection/meta.yml

@@ -11,7 +11,7 @@ prerequisite_capabilities:
   - GitHub Advanced Security enabled on the shared org repo
   - GitHub Copilot license assigned
   - Basic familiarity with Node.js/Express and SQL queries
-  - Completed S00 (attack surface overview) recommended
+  - Completed S01 (attack surface overview) recommended
 description: Fix real SQL injection and NoSQL injection vulnerabilities in Juice Shop backend routes identified by CodeQL, using parameterized queries and ORM-safe patterns; open pull requests and verify fixes via PR code scanning checks.
 success_criteria:
   - At least 2 injection vulnerabilities fixed in the code

modules/ghas/challenges/s03-fix-xss/README.md

@@ -1,4 +1,4 @@
-# Challenge S-02: Fix XSS & Unsafe Output
+# Challenge S03 — Fix XSS & Unsafe Output
 
 ## Description
 

modules/ghas/challenges/s03-fix-xss/meta.yml

@@ -11,7 +11,7 @@ prerequisite_capabilities:
   - GitHub Advanced Security enabled on the shared org repo
   - GitHub Copilot license assigned
   - Basic familiarity with HTML/JavaScript and frontend frameworks (Angular)
-  - Completed S00 (attack surface overview) recommended
+  - Completed S01 (attack surface overview) recommended
 description: Fix cross-site scripting (XSS) vulnerabilities in Juice Shop by applying correct output encoding and safe framework APIs; trace data flows from user input to HTML output and verify fixes through PR code scanning annotations.
 success_criteria:
   - At least 2 XSS vulnerabilities fixed

modules/ghas/challenges/s04-broken-access-control/README.md

@@ -1,4 +1,4 @@
-# Challenge S-03: Fix Broken Access Control
+# Challenge S04 — Fix Broken Access Control
 
 ## Description
 

modules/ghas/challenges/s04-broken-access-control/meta.yml

@@ -11,7 +11,7 @@ prerequisite_capabilities:
   - GitHub Advanced Security enabled on the shared org repo
   - GitHub Copilot license assigned
   - Basic familiarity with Node.js/Express route middleware and authentication patterns
-  - Completed S00 (attack surface overview) recommended
+  - Completed S01 (attack surface overview) recommended
 description: Identify and fix broken access control vulnerabilities (IDOR, missing authorization middleware) in Juice Shop backend routes; enforce server-side ownership checks and role-based authorization in route handlers.
 success_criteria:
   - At least 2 access control vulnerabilities identified and fixed in route handlers