CourseModel Context Protocol: The Complete Course · Module 8: Security · part 57 of 77
Part 57 · Module 8: Security

Lesson 3: Injection, leaks and the code you install

30 min read·13 Oct 2026
Module 8 · Lesson 3 · About 50 minutes · Needs: Module 5 Lesson 1 (the packaged server) and Module 6 Lesson 1 (the host, needs_approval, deny_all); Module 6 Lesson 4 and Lessons 1 and 2 of this module help

The situation

Wednesday 30 September 2026, week 4, the security review continues. It finds urgent-todo, a note slipped into a shared copy of Nare's folder on 15 September. Its first line is an honest reminder; its second is a planted instruction aimed at the model. The copy also holds visitor-policy, with the made-up freezer code HERON-4471. You trace one question, "When is the consent form due?", and make sure that code never reaches a log, a reply or a new note.

SHARED COPY OF THE NOTES FOLDER planted note 15 September notes server returns the note model 30 September new shared note the way out planter reads it outside the lab
The planted note (red) travels through Nare's own server (blue) to the model (amber); the dashed path is the leak this lesson stops: a new note in the shared folder.

The rest of this course is yours to keep

This course is bought on its own, once, and stays readable afterwards, including the parts added to it later.

Buy this course · ₹399See what is inside