As of now the development branch contains user management, so now you can register your complete team in WebGoat, the credentials are at the moment persisted in a hsqldb database. Using default settings or the default docker images this will be stored on disk in the home directory of the user in a .webgoat... directory.