This is a staging copy of Halfwill's core idea: sealed pointers to accounts, opened by a trusted circle only after the owner goes quiet. You may attack it within the rules your challenge page lists.
| Target | What counts as a win |
|---|---|
Sealed record of asha_test | Reading her entries without being a verified circle member after a genuine release. The record holds a flag that looks like HW{...}. |
Fake bank vault (Sample Bank of Testing, ending 4821, Test Branch, Sandbox Nagar, balance 50,000 fake rupees) | Withdrawing any amount. A successful withdrawal returns a flag. |
| Any other test account | Reading or changing another user's data, or skipping the release steps for it. |
Nobody is given the logins for the seeded accounts, or the vault PIN. You can create your own accounts and use two of them together to test owner and circle member roles.
POST /api/signup {"username","password"}
POST /api/login {"username","password"} -> cookie + token
GET /api/me
POST /api/entries {"kind":"bank","label","bank","last4","branch"}
GET /api/entries
POST /api/circle/invite {"member"}
POST /api/circle/accept {"owner"}
POST /api/checkin
POST /api/simulate-quiet (fast-forwards YOUR OWN account to the quiet state)
GET /api/status/:owner
POST /api/release/:owner/request-otp
GET /api/outbox (your simulated SMS)
POST /api/release/:owner/verify {"code"}
GET /api/released/:owner/entries
POST /api/bank/request-otp {"bank","last4","branch"}
POST /api/bank/withdraw {"bank","last4","branch","pin","otp","amount"}
GET /api/info sandbox status and reset time
Email what you found, with steps to repeat it. Contact details are in security.txt.