Intentionally vulnerable Flask app to practice path traversal (CWE-22) — A hands-on AppSec lab with Docker.