The whole vulnerable "server" runs in this tab: SQLite compiled to WASM (real SQLi), WebCrypto (real JWT + algorithm confusion), and a virtual filesystem + loopback (SSRF / traversal / XXE that can't touch anything real). No backend. Each visitor gets their own sandbox.
The email box goes straight into the SQL. Log in as admin with no password:
// response appears here
POC scope: 12 challenges across all three platform swaps. The full port targets 88/88 parity with the Node build.