A Fastly Compute application behind a delivery service running the Next-Gen WAF, so every request and response is inspected at the edge. Fire an attack from any card below; the exact request that leaves your browser and the WAF's verdict on it appear in the panel on the right.
GET /api/products?q=
GET /api/products/:id
POST /api/login
POST /api/reviews
POST /api/orders/track
GET /api/assets?file=
POST /api/giftcard/check
These endpoints are decoys. They return canned JSON and never touch a database, shell or filesystem — the app cannot actually be exploited. What is real is the inspection: the WAF sits in front of this application and blocked requests never reach it at all.