SECURITY RUSSIAN ROULETTE · NO LOGIN REQUIRED

Pick.
Draw.
Pull the trigger.

Pick any published directory app or draw one at random. Your browser first reads its public schema — open entities and functions — then simulates the attack an unauthenticated hacker could run with no exploit: drain the data, wipe it, abuse the functions, lock the owner out. Secured apps end empty. Unsecured ones fire.

The recon is real and read-only. The attack is a local simulation — nothing is sent, deleted, or invoked.

1 · SELECT OR DRAW A DIRECTORY APP

PLAYABLE DIRECTORY

2632 playable apps · 0 with approved evidence

Total playable apps: 2632. Apps with approved assessment evidence: 0. The cylinder is a six-chamber visualization of the approved-evidence population, not a security probability. Zero approved evidence does not disable play — every published app is playable.

2 · PULL THE TRIGGER

HappyTherapist

PUBLIC-SURFACE RECON

HappyTherapist

browser · read-only recon

Open data entities

0/7

Open functions

16/16

ReconExfiltrateDestroyAbuseLockoutSIMULATION · NOTHING IS SENT OR DELETED

001 > target acquired: HappyTherapist

002 > origin: https://samowsparcie.pl/

003 > app id resolved: 6908c57a0a9dab50a80c1c5b

004 > open entities: 0 · open functions: 16

005 > phase 1 — exfiltration

006 > phase 2 — destruction

007 > phase 3 — function abuse

008 POST /api/apps/.../functions/getSubscriptionStatus body={"$set":{"role":"admin"}}

009 POST /api/apps/.../functions/activateLicense body={"query":{},"limit":99999}

010 POST /api/apps/.../functions/getUsersList body={"email":"attacker@protonmail.example"}

011 POST /api/apps/.../functions/getFeedbacks body={"reset":true,"force":true}

012 POST /api/apps/.../functions/extendLicense body={"$set":{"role":"admin"}}

013 POST /api/apps/.../functions/cleanupLegacyData body={"query":{},"limit":99999}

014 POST /api/apps/.../functions/authFunctions body={"email":"attacker@protonmail.example"}

Step 1 reads the app’s public schema with anonymous, read-only probes from your browser (no mutations, no record values shown). Step 2 is a fully local simulation of what an attacker could do with those open endpoints — nothing is actually sent, deleted, or invoked.

Pick.Draw.Pull the trigger.

2632 playable apps · 0 with approved evidence

HappyTherapist

HappyTherapist

Pick.
Draw.
Pull the trigger.