Open-source playground: a real scope-escalation flaw in an agent access-key exchange, plus a greenfield Descope OTP task. 20 minutes, no accounts, no keys.