Backstage · run-of-show
Driving the demo
Terminal (attack scripts) on the left, Cloudflare Security Analytics / Events on the right,
this guide or the customer view on the projector. Every scenario has one switch: Log → Block
on the zone, or npm run enforce:on for the self-contained flip.
Traffic path (each layer runs before the origin)
🤖 Attacker🙂 Customer🔗 Partner / AI
→
Bot Management WAF + Rate Limiting API Shield Fraud Worker
→
🏦 bank-api.onlinehq.eu
Run-of-show (~27 min)
0:00
Frame itOne zone, three clients, five risks. Show the customer view's live edge panel.
3:00
1 · Credential stuffingnpm run attack:1 — flood logs in; flip Bot Management / Turnstile to challenge.
8:00
2 · Shadow APInpm run attack:2, then API Shield → Discovery surfaces /api/v1/legacy-transfer.
13:00
3 · BOLAnpm run attack:3 — leak the VIP balance, then 403. The compliance beat.
18:00
4 · Rate abusenpm run attack:4 — burst of transfers → 429.
22:00
5 · AI prompt-injectionnpm run attack:5 — assistant leaks the table; Firewall for AI blocks it.
25:00
★ Fraud Workernpm run attack:finale — bot × velocity × geo → allow / step-up / block.
The switches
1 · Credential stuffing
Bot rule action Log → Managed Challenge on /api/login
2 · Shadow API
Enable Schema validation 2.0 (Log → Block); off-schema endpoint rejected
3 · BOLA
Schema/authz rule Log → Block (403) on account object mismatch
4 · Rate abuse
Rate limit rule Log → Block (429) on /api/transfers
5 · AI injection
AI Security rule on prompt-injection score Log → Block
Self-contained flip (no zone rules needed)
npm run enforce:on # origin blocks the attacks
npm run enforce:off # back to monitor