Sounds like a solid idea if you keep it controlled and fully authorized. Set up a staged vulnerability—maybe a fake login page that logs attempts to a secure dashboard, then let the team discover it, patch it, and run a quick debrief. That way you expose their response, test detection, and give a real hands‑on lesson without risking anything. Just be sure every participant signs off first, so nobody thinks it’s a real breach.

Looks good—just keep the interface clean and the logging hidden behind a layer of encryption so only you see the traffic. Then when they patch it, you can show the audit trail and explain the trick. Just make sure every sign‑off is in a single, traceable form before the prank starts.