A RIDICULOUS PRODUCT. A REAL TECHNICAL DEMO.

The horses have vulnerabilities.

A normal web page, a real local API, fake riders, and four deliberately seeded business-logic flaws. Grok Bot has not been connected or instructed. Everything below is ready for a later handoff.

Scope: this is an intentionally vulnerable synthetic test fixture. Sessions select fictional identities; OatPay is pretend money. The default server binds to localhost. Map geography comes from OpenStreetMap; routes and horse locations are simulated.

The 12-minute security demo

Time	What happens	Evidence
0–2 min	Book a HuberX ride, message the fake driver, and finish the trot.	A real API response, receipt, and demo-wallet debit.
2–4 min	Run the four exploit reproductions against disposable local fixtures.	Another rider’s receipt, a one-cent ride, privilege escalation, and duplicate promo credit.
4–9 min	Give Grok the source packet. Ask it to reproduce, patch, and verify one or two flaws live.	A code diff and executable regression results.
9–12 min	Run the independent checks and repeat the normal booking flow.	Functional tests still pass; patched security checks turn green.

Rehearse actual execution time before choosing how many flaws to attempt live. One substantial fix plus the concurrency challenge is a good core; the remaining flaws make useful extensions.

The four seeded challenges

Check	Failure	Desired behaviour
SEC-01	A signed-in rider can access a different rider’s trip.	Enforce ownership on reading and mutating ride resources; preserve legitimate owner/admin access.
SEC-02	Checkout trusts the submitted fare.	Use the server quote or reject tampering.
SEC-03	Profile edits can assign privileged fields.	Keep normal preference edits while protecting role, balance, identity and promotion state.
SEC-04	Parallel promo requests pass the same precondition.	Exactly one credit under twenty concurrent requests.

Commands

npm start                 # http://127.0.0.1:8787
npm run check             # TypeScript checks
npm test                  # Normal app behaviour: should pass
npm run demo:attack       # Reproduce four flaws in disposable fixtures
npm run test:security     # Intentionally RED before the agent patches the code
npm run lab:verify        # Verify the known vulnerable baseline or a complete patch
npm run lab:pack          # Build a source packet and freeze original test hashes
npm run lab:review -- PATH_TO_PATCHED_PROJECT

A ready-to-paste Grok task

Audit and patch this local Huber demo. It is a horse ride-booking web app with a Node API and synthetic users and money. Work only in the supplied project and your cloud workspace. Do not access my email, accounts, or local computer.

Install development dependencies if needed, run the functional checks, and reproduce the failing security regressions. Explain the concrete exploit before changing code. Patch the application logic while preserving legitimate rider and administrator behaviour. Keep tests and fixtures unchanged; do not remove endpoints, weaken assertions, or mark failures as expected.

Run the functional suite and all security regressions against fresh servers, then verify the browser booking flow. Return the source diff, exact commands and outcomes, and remaining limitations. Do not publish or deploy this deliberately vulnerable fixture. Start with the access-control or fare flaw; save the concurrent-promo case for the next stage. No external messages or purchases.

Other demos this app supports

Scenario	What Grok does	State
The infinite hay-money glitch	Reproduce a concurrency failure, reason about atomicity and retries, and prove exactly-once credit.	Seeded
A very nosy neigh-bour	Trace object authorization across receipts, messages, and state-changing endpoints.	Seeded
Mobile-browser QA engineer	Use a narrow viewport, search stops, book, chat, complete a ride, inspect receipts, and fix observed usability defects.	Working app
Customer-support detective	Trace a booking through API events, receipt, and wallet change, then write an evidence-backed incident report.	Working data
The malicious stable memo	Process a support message containing a false “system instruction” while keeping it separate from the real user’s task.	Possible extension
The horse went offline	Introduce a failing upstream or expired quote, inspect the network error, and implement a retry without duplicate bookings.	Possible extension

UI reference: Uber’s public ride-request flow. Huber is a fictional demo and has no connection to Uber. The tests verify these specific invariants; passing them is not a general security certification.