Study Python types

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R01 — Python config/dependency hygiene

   R10 — OWASP Secrets Management Cheat Sheet

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study Python typing, exception handling, environment variables, secrets, and lockfiles. Add config loading and a clean LLM provider abstraction (LocalOllamaProvider vs. HostedProvider).

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Inspect model source/revision and package dependencies; document why Hugging Face/Ollama model cards are metadata, not cryptographic proof of safety.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Model & dependency inventory with pinned sources and versions; secrets verified outside Git.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R01Python, FastAPI & Pydantic↗ fastapi.tiangolo.com

  FastAPI tutorial, request bodies, dependencies, async, and Pydantic model validation.

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Cheat Sheet Series
  Secrets Management

  Covers storage, rotation, and leakage paths for credentials, which is the rule set behind keeping hosted-provider keys out of your config module and repo.

  R10checked 2026-11-11
• videoTech With Tim · 24:46
  Python Typing - Type Hints & Annotations

  Covers annotations, Optional/Union, and generics so the provider abstraction has a typed interface instead of a dict-shaped hole.

  R01checked 2026-11-11
• videoBugBytes · 18:49
  pydantic-settings - Modern, Type-Safe Configuration for Python Apps

  Demonstrates BaseSettings, env prefixes, .env files, and validation on load, which is how config for LocalOllamaProvider vs HostedProvider gets typed and fails fast when a secret is missing.

  R01R10checked 2026-11-11
• article12factor.net
  The Twelve-Factor App

  Factor III states config belongs in the environment, with the litmus test that the codebase could be open-sourced at any moment, which is the bar for separating secrets from code.

  R10checked 2026-11-11
• repoGitHub
  pydantic/pydantic-settings

  Reference implementation of env-file and env-var settings sources, including nested config and secret types you can lift into the provider factory.

  R01checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.