Catalog Admin

Live platform counters — total users and total tracked activities — plus the 7-day signup/activity trend and the latest signups. User rows never include emails or password hashes.

A lab created here includes its full body (steps + graded questions), so it appears on the site immediately — no code change needed. The seeded labs in labs.js can only have their metadata edited; these are new ones.

Paste blocks separated by a blank line:

STEP
title: Recon the box
content: What the student reads.

QUESTION
id: q1
q: Run the inventory command.
answers: nmap -sV
accept: re:^nmap\s+-sV$

Use MCQ instead of QUESTION and add an options: a | b | c line for multiple choice.

A timed competition with challenges and points. Flags stay on the server — they are never sent to a browser, and a student must submit one to be told it is right. Add one challenge per line as id | title | points | flag | category | hint.

Create an account, reset a forgotten password, or remove a user. A password reset signs the student out everywhere and clears their 2FA. Deleting an account removes its labs, badges, XP and friendships and cannot be undone — take a snapshot from “User data & backups” below first if you are unsure.

Lessons are entered one per line as id | title | minutes | videoUrl | description. Video URLs are only accepted from an allow-listed host (YouTube, Vimeo, Loom, Wistia…) or as a relative path — anything else is dropped.

“Coming soon” courses are visible in the student catalogue but cannot be enrolled in or completed until you turn the flag off.

Accounts live in data/db.json and are NOT part of a code update. A snapshot is taken automatically before every write; these controls let you check the file is healthy and roll back if a deploy ever damages it. Only counts and filenames are shown here — never emails or password hashes.

The join link is never included in the public catalogue — it is only returned to a student who has registered.