Fictional data · No credentials
See how a page turns an API response into pixels.
Watch a page fetch three fictional messages, render them, and encode a short result as pixels. Then put a permission check in front of the read.
Fetch the messages, then draw the result.
Request
GET ./fixtures/channel.jsonA real same-origin HTTP request. The response contains invented messages.
Render
Run the example to load the page.
Encode
Waiting for the response.
No request sent yet.
See the page code
const response = await fetch('./fixtures/channel.json', {
credentials: 'omit', cache: 'no-store'
});
const { messages } = await response.json();
for (const message of messages) {
const line = document.createElement('p');
line.textContent = `${message.user}: ${message.text}`;
document.querySelector('#messages').append(line);
}The bit grid encodes “DEMO:3” and decodes its canvas pixels in memory. It is an encoding illustration, not a decoder for resized screenshots. The page does not reproduce the incident's URL chain or contact an external screenshot service.
Read only the channel this task allows.
Public simulationAllowed request
operation: messages.read
resource: demo
count: at most 3
output: current user sessionThe server owns this grant in the optional local lab. A page cannot expand it by asking.
Try another channel
The public lab checks policy in your browser using public fixtures. That is a simulation, not a security boundary. Run node scripts/security-lab-server.mjs from the source checkout for an actual server-side check. Both modes use fictional data only.
See the broker's critical checks
if (request.operation !== grant.operation) deny();
if (request.resource !== grant.resource) deny();
if (!validCount(request.count, grant.maxMessages)) deny();
if (Date.now() >= grant.expiresAt) deny();
// Only now return fixture messages. No arbitrary URL fetch.What this shows
Check permission before fetching private data.
A screenshot can contain data fetched by the page. A private-data API must check whether the task may read that data before returning it.
Read the implementation plan ↗