INFRASTRUCTURE FIXTURE · SYNTHETIC ONLY

Framing & proxy test lab

These default controls exercise an intentionally weak dummy, not the VEX router. They never deliver SMS. Separately registered live cases are available only through their private, expiring links.

Checking dummy configuration…

Controls and attack variations

Each launch uses a fresh run ID. The server records synthetic authorization/SMS outcomes and fetch metadata. A visible response alone is not a security verdict.

Current run

No case launched.

Reading results

The dummy should block ordinary frames. Framed fetch and report rewriting intentionally demonstrate why a nonce is not proof of top-level browsing. Dummy SMS only records an event: no provider is contacted.

Evidence is retained on the host, outside the public web root. Dummy results do not establish real-target protection.