WELCOME TO GUARDRAIL

Try it. Understand it. Fix it.

A hands-on space to explore security weaknesses and see what changes when the defenses are switched on.

START HERE · NO SIGN-IN NEEDED

Curious about how a vulnerability actually works?

Pick a lab, run a test against the vulnerable version, then try the protected version. You’ll see the result and the evidence behind it, so you can understand what went wrong and how the fix helps.

Choose something to test

Start with XSS to see how untrusted input can become executable code. Then explore prompt-injection simulations or authentication and access checks.

Compare before and after

Run the vulnerable fixture first, then the hardened fixture. Open each result to see what happened and which defense made the difference.

Keep the evidence

Compare your runs and export a result. Use the explanation to connect the observed behavior with the underlying security issue.

Want to follow a full investigation?

The ticket sandbox lets you explore who should be allowed to read a ticket, then follow the activity through to an alert and a fix.

Run the investigation below. The vulnerable fixture lets Alice read Bob’s ticket. The protected policy blocks repeated attempts.
Open Activity & alerts. See the access-denied events and why they triggered an alert.
Open Findings & fixes. Read the ticket ownership finding and its recommended fix, then run the hardened checks.
Try the Security lab. Switch between the synthetic users and see which tickets each one can access.

A safe place to experiment

Everything runs against built-in fixtures and synthetic data. You’re not scanning another website, and the prompt-injection lab is a simulation.

Passing a check means that fixture passed that test. It isn’t a guarantee that an entire application is secure.

A few things to know

You can use the labs without signing in. Anonymous visitors share a demo workspace, so saved activity may include other visitors’ runs.

Use the sidebar to switch sections. Click Guardrail at the top whenever you want to return here.

Explore the source