WebGoat is a deliberately insecure web application designed for security training, providing hands-on lessons for the OWASP Top 10 vulnerabilities. In production, it operates as a Spring Boot monolith with a modular lesson architecture; each lesson is a self-contained endpoint that simulates a real-world vulnerability (SQL injection, XSS, CSRF, JWT misuse, etc.) and validates the user's attack payload. A companion application, WebWolf, acts as attacker infrastructure (file hosting, JWT encoding/decoding, request logging). The system includes user registration, progress tracking via JPA/Flyway with per-user database schemas, and a Thymeleaf/Backbone.js frontend with multilingual support. External dependencies include H2/HSQLDB, Spring Security, AsciiDoc rendering, and intentionally outdated libraries (e.g., jQuery 2.1.4) to demonstrate specific weaknesses. The architecture is well-structured but carries intentional technical debt for educational purposes. The most reusable components are the WebAuthn support utilities (CBOR, COSE, attestation parsing) and the command execution service, both of which demonstrate non-obvious engineering skill and can be extracted independently.