Security Test Lab
A deliberately vulnerable full-stack app on Workers + D1. Use it to exercise WAF managed rules, Rate Limiting, API Shield and monitoring.
SQL Injection
XSS
Path Traversal
SSRF
IDOR
Broken Auth
Read the blog Watch videos
Login SQLi
Bypass auth on /login.
Stored XSS
Inject script in blog comments.
SSRF proxy
Fetch any URL via /api/fetch.
IDOR
Read any user at /api/users/:id.
Contact: support@test.com