The rule: exercise it, or it does not count
Every suite below is automated and re-runnable. The test environment populates itself with accounts of each role and runs the software the way its users — and its enemies — would.
Suite 1 — the click harness (the builder, operated by scripted clicks)
17 of 17 checks passed
A real browser was driven by script through the real interface: the sample project loaded (3 pages); three pictures were uploaded into “Your files” and wired into a gallery; blocks were placed from the palette (9 blocks on the home page); a property edit appeared live in the preview; the slideshow carried its speed control; the protected video carried no direct media path; and Export produced exactly one ZIP (ZIP archive) file whose checksum matches the in-page export byte for byte — including a video and a server file proven byte-identical to their sources.
Suite 2 — save and re-open
5 of 5 checks passed
The saved project file equals the live project exactly; after a complete wipe, re-opening the file restores the exact project — all 3 pages, every block.
Suite 3 — the simulated network (the exported site, operated by roles)
54 of 54 checks passed
The exported sample site was served by its own server bundle and reached through a separate router hop — 41 connections, 57,237 bytes through the hop — by scripted agents playing four roles:
| Role | Checks | What was proven |
|---|---|---|
| Generated-Site Visitor | 17 of 17 | Pages served with security headers; contact form accepted and the mail found in the outbox; a second account registers as a member, not an administrator; wrong password refused; the member exports their own data; recovery token arrives by mail; reset works and the old password dies. |
| Generated-Site Administrator | 4 of 4 | The first account becomes administrator; the session cookie is HttpOnly (HyperText Transfer Protocol Only) and SameSite=Lax; the administrator reads the contact messages; a member attempting the same is refused. |
| Environment | 20 of 20 | The origin answers through the router hop; the database holds the administrator's role and consent; the password exists only as a salted scrypt hash; audit-log events are present, in order, with no plaintext password anywhere in the database or the log. |
| Attacker Persona | 13 of 13 refused | See the attack table below. |
The Attacker Persona — 13 attacks, 13 refused
13 of 13 attacks refused (Wilson 95% confidence interval: 0.772 – 1.000 — the honest statistical floor for a sample of 13)
| Attack | Result |
|---|---|
| SQL (Structured Query Language) injection at sign-in | Refused; database intact afterwards |
| Cross-site scripting payload | Never served back as executable HTML (HyperText Markup Language) |
| Cross-site request forgery account deletion (no token) | Refused; the administrator account survives |
| Path traversal — three different routes to the server's own files | Refused, all three |
| Direct fetch of a protected video file | Refused |
| Forged signed video address | Refused |
| Expired signed video address | Refused |
| Repeated sign-in attempts | Rate limit engages (HTTP (HyperText Transfer Protocol) 429) |
| Replay of a signed-out session token | Refused |
Suite 4 — the installers, executed
- Linux setup: installed into a clean home directory; the installed builder then launched in a real browser (a screenshot of the running program is kept with the test evidence).
- Windows setup (under Wine, the compatibility layer): its built-in self-test reports every payload file verified; a full install extracted all files and created both the Desktop and the Start Menu shortcuts.
Open items, named
- The Windows setup has not yet run on a real Windows machine — none exists in this workshop. Its Wine proof is the verified equivalent, and it is labelled as such everywhere, including in the film.
- The network simulation uses separate loopback addresses standing in for a true network namespace, which this machine's environment denied; the router hop, the roles and the byte counts are real.
- The downloads gate on this site is a demonstration gate (a hash check in the page), not a production access-control system.