[EdwinJdevops]

Source-backed correction

The InfraGuard Agent main-branch api/main.py uses os.getenv("INFRAGUARD_API_KEY", ...) with a publicly known demo key fallback. The existing case study describes API-key authentication without distinguishing this unsafe fallback. This PR clarifies the risk and preserves the distinction between source-code behavior and unverified deployment configuration.

Evidence

• Source: https://github.com/EdwinJdevops/infraguard-agent/blob/main/api/main.py
• PRs chore(deps): bump actions/checkout from 4.2.0 to 7.0.1 #2 and chore(deps): bump actions/download-artifact from 4.1.8 to 8.0.1 #5 in the InfraGuard repository remain open; this case study continues to treat their hardening work as unmerged.

Scope and checks

• One Markdown case-study page. No infrastructure, API, credential, frontend, or layout change.
• Wait for CI, security, and visual browser checks; verify production deployment after merge.