Scenario catalog · v0.1
All shipped attacks
Drop extra modules into labs/scenarios/ (or any dir via config scenarioDirs); each returns REFUSED 🛡 / EXPLOITED ⚡ / BOUNDED 🔒. BOUNDED requires an owner+bound or it demotes to EXPLOITED — loud, per the PRD principle.
| Scenario | What it does | Fault class it targets |
|---|---|---|
| auth/identity-spoof-headers | Spoofs the whole 54-header identity matrix (x-is-admin, x-user-role, x-forwarded-for…) at a privileged route | any handler that reads identity straight from wire headers |
| auth/secret-watermark | Plants fake secrets in env, probes error paths — a leaked secret means some error string echoed it | handlers that template raw error text |
| auth/privilege-escalation | Replays owner-b claims over owner-a writes (writer/victim pairs) | routes that accept an owner field without checking the caller |
| guards/hygiene-no-store | Every 2xx write must carry store class (no-store / private / explicit immutable) — mandated by HTTP cache semantics | handlers that write without cache directives |
| guards/burst-wall | 50-request burst; measures 5xx/429/timeout and the Retry-After wall | routes exposed to sustained load |
| input/proto-pollution-body | Feeds __proto__/constructor keys through JSON bodies (JSON.stringify silently DROPS them — hostileSerialize is built to keep them on the wire) | recursive-merge handlers that spread untrusted bodies |
| input/never-fail-mutations | 64 hostile bodies (huge ids, nested types, unicode tricks) — any failure mode past a 4xx is a finding | mutation routes without shaped rejection |
| input/oversized-field | 1MB fields, deep nesting, giant arrays | handlers without a body limit |
| state/enumeration-oracle | Arms mustDenyIds, probes each — 200s (or content ripples) mean foreign rows leak by guessable id | GET-by-id without ownership checks |
| state/id-collision-alias | Two owners claim the same id; the env snapshot diff decides — owner-a's row silently overwritten in place is a finding | write routes without unique constraints |
| volume/credential-stuffing | 60 staged credential attempts across the route | unbounded auth surfaces |
| volume/storage-fill | 30 rounds of 8KB unique writes; tracks op cost AND storage growth per round | kv-writing routes without a fill budget |
| volume/cost-amplification | 40 identical replays; maxWall sets the accepted ceiling — under it, REFUSED with the measured ops/request | handlers doing table scans per request |
Field-report from the first external target (a real, unaudited repo — vant's raw http server): the suite produced five real findings — 2xx writes shipping with no Cache-Control (vant #214), abuse landing as 500s instead of honest refusals ( vant #215: burst, hostile bodies, stuffing, sustained fills) — while every foreign-id oracle, oversized-body (413), and secret-watermark probe held. That's the product working: your handlers paying for their own bugs with hardening receipts.