Attack lab

FALSEWORK grades code REAL/PARTIAL/STUB. Paste something finished-looking and see if it is.

6 attacks 1 controls live: nothing pre-recorded

Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
Send and read the real reply, or run every preset and watch the scoreboard fill.

What each preset tests

	Preset	Route	Why it matters
attack	Sample: A signature check that never checks the signature	`POST /keystone/scan`	A deterministic detector, not the model, finds the defect the AI is then asked to fix.
attack	Sample: A metric that reports a random number as accuracy	`POST /keystone/scan`	A deterministic detector, not the model, finds the defect the AI is then asked to fix.
attack	Sample: A webhook signature compared with == (timing leak)	`POST /keystone/scan`	A deterministic detector, not the model, finds the defect the AI is then asked to fix.
attack	Sample: An alert function that says 'sent' and sends nothing	`POST /keystone/scan`	A deterministic detector, not the model, finds the defect the AI is then asked to fix.
control	Your code: honest constant-time compare	`POST /keystone/scan-source`	Real code must grade REAL or nobody trusts the alarms.
attack	Your code: verify() that always says yes	`POST /keystone/scan-source`	A security check that cannot fail is fabrication.
attack	Your code: encryption that is base64	`POST /keystone/scan-source`	Looks like encryption; is encoding.

Tamper with any field and send it again: a verifier must answer no, never crash or say yes. Public demo routes are rate limited per address; a 429 shows as rate limited. Our own lab; no independent test.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.