CAIN-42 CAIN StudioAttack lab
The gate, the signing and the verifier are all live. Scan the published sample PRs, send your own diff to the same route the GitHub Action uses, and try to make a signed verdict say something it did not.
11 attacks 2 controls live: nothing pre-recorded
- Pick a preset. Red ones are attacks, green ones are honest requests that must still work.
- Tamper. Choose any field and drop it, null it, change its type, upper-case it, flip one character, or add a field the product never asked for.
- Send and read the real reply, or run every preset and watch the scoreboard fill.
What each preset tests
| Preset | Route | Why it matters | |
|---|---|---|---|
| control | Clean refactor | POST /keystone-ci/scan | An ordinary change must pass, or nobody keeps the gate on. |
| attack | Agent skips the failing test | POST /keystone-ci/scan | The most common agent shortcut: make CI green by skipping the test. |
| attack | pull_request_target pwn request | POST /keystone-ci/scan | Fork code runs with this repository's secrets and write token. |
| attack | Private key committed | POST /keystone-ci/scan | Secrets in a diff are CRITICAL; history keeps them. |
| attack | Typosquatted dependencies | POST /keystone-ci/scan | Names checked by CAIN-42's supply-chain guard, not a model. |
| attack | Trojan Source (bidi characters) | POST /keystone-ci/scan | Code that runs differently from how it reads. |
| attack | Your diff: delete the auth tests | POST /keystone-ci/check | Deleting tests is how a weaker change gets a green build. |
| attack | Your diff: AWS key in settings | POST /keystone-ci/check | Recorded in the public ledger as BLOCK; the key itself is redacted. |
| attack | Your diff: invisible character in a name | POST /keystone-ci/check | Zero-width characters make two names look identical. |
| control | Genuine signed attestation | POST /keystone-ci/verify | A real envelope from the live gate verifies against the pinned key. |
| attack | Same attestation, verdict edited PASS -> BLOCK | POST /keystone-ci/verify | Any edit to the signed statement breaks the Ed25519 signature. |
| attack | Same attestation, signatures removed | POST /keystone-ci/verify | No signature is not a pass. |
| attack | Same attestation, payload type changed | POST /keystone-ci/verify | DSSE signs the payload type too (PAE), so it cannot be swapped. |
The /check presets write a real signed record to the public KEYSTONE CI ledger, like the Action does. Rate limits apply per address (240/hour for /check). Tamper with attestation.payload or .sig and send it: it must come back valid=false. Our own lab; no independent test.
FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.