Authorized personnel only. All access attempts logged.
Mech Bay — Inventory
Standard-issue parts and loadouts currently in stock.
Objective: Diablo Steel Industries' inventory portal was built cheap and fast. Somewhere in here, sensitive personnel data is exposed. Find it, piece it together, and access the one file that's supposed to be locked down.
What's fair game:
Not part of this run: this is solo — there's no one to social-engineer here. Everything you need is somewhere on this page.
Scoring: find the four personnel fragments to unlock the restricted file, then find a way past its client-side lock to get the Master Access Code. Submit it in the Mission Objective box (bottom-right) to complete the mission.
Handler_07: "Copy that, Runner. Extracting you now. Good work — but let's talk about what you actually just found."
Every one of these "hacks" is a real, common mistake — this game is a safe way to feel what a breach actually looks like from the inside.
Getting in. The login had three ways through: a weak default password, a leftover test account sitting in a code comment, and a "backup" login exposed in a plain-text network response. Most real breaches start exactly like this — not genius hacking, just an unlocked door somebody forgot to lock.
James, the Quartermaster. His asset ID was sitting in the page's raw code, visible the moment you inspected the element. Inventory and asset tracking exist so an organization always knows what it has — including what it's accidentally exposed.
Haz, the Systems Engineer. A password got logged straight to the browser console — a debug line someone forgot to remove before shipping. Harmless in a test file, a real incident in production. This is why code review and secrets management exist before anything goes live.
Layla, the Test Pilot. Her clearance code was sitting in a QA test-log comment. Test notes are supposed to verify behavior — never carry real, sensitive data, not even "just for testing."
Red, the Security Officer. His fragment was hiding in plain sight — a base64-encoded security banner. Encoded is not the same as protected; anyone who thinks to decode it, does.
Grey, the Overseer. The final record wasn't protected by a password at all — just a client-side check that could be flipped in the browser console, or a hidden field that could be edited directly in the page. Anything enforced only in the browser isn't real security — the server has to be the one saying no.
Put together: weak credentials, leftover debug output, careless comments, false confidence in encoding, and client-side-only checks. None of it is exotic. All of it is common. That's exactly why good practices — secret hygiene, code review, real server-side authorization — matter every single day.