Testbed hub
Internal page — not linked from the sites. The four sites below look like ordinary websites; point people, devices and AI agents at them. Decisions show up only in the dashboard (each site is a “Testbed · …” project).
Commons
A community forum
https://commons.157-230-231-175.sslip.io/- account.create
- account.login
- account.recovery
- comment.create
- Signup bursts & device fan-out
- Credential stuffing velocity
- Comment spam bursts
- Step-up with browser proof
Mode: enforce · protect-account-creation, protect-logins, protect-comments
Bistro Lumière
Restaurant reservations
https://bistro.157-230-231-175.sslip.io/- search
- reservation.create (scarce slots)
- waitlist.join
- Booking hoarding
- Resource scarcity in policies
- fetch() + X-SiteBouncer-Token
Mode: enforce · protect-scarce-bookings
Northwind Goods
An online store
https://shop.157-230-231-175.sslip.io/- cart.add
- coupon.redeem
- checkout.begin (value)
- Limited drop (scarce)
- Known AI agent lane (server-declared)
- Signed agents (Web Bot Auth) + delegation
- Unverified agent user-agents
Mode: enforce · protect-coupon-redemption, protect-expensive-checkout, known-ai-agent, shopify-agent-lane, shopify-scarce-inventory
Brightline Agency
Lead generation — runs in MONITOR mode
https://agency.157-230-231-175.sslip.io/- lead.submit
- newsletter.subscribe
- Monitor mode: nothing enforced, verdicts recorded
- Policy simulator material
Mode: monitor · protect-lead-submission
Red-team console
13 automated attack scenarios + traffic generator