Execution and limits

Access makes real same-origin Worker HTTP requests with public synthetic fixtures. Actor selection is not authentication. SQL runs real SQLite in a disposable browser Web Worker, not a server database. XSS executes a harmless marker inside a sandboxed iframe with no same-origin permission; notice storage is browser-local. Write gates, TCP, DoS, TLS, HSTS and firewall rules are models, not live bot verification, packet captures or network attacks.

Reset removes this app’s observation list, notice and virtual gate state. It does not clear history, downloads or DevTools logs. No persistent server storage is used. Hosting can retain ordinary request metadata.

Primary references

• OWASP Authorization
• OWASP SQL injection
• OWASP XSS prevention
• sql.js · MIT; SQLite · public domain
• RFC 9293 TCP
• RFC 4987 SYN floods
• RFC 8446 TLS
• RFC 6797 HSTS
• Turnstile server verification

Checked 15 October 2026. Bundled SQLite WASM: sql.js 1.15.0; vendor/LICENSE.