Each demo runs five checks against a simulated system. Watch a defect fire, flip one switch, and watch the same check pass.
Nothing to install, no signup, and no data leaves your browser — the API is simulated in the page itself.
A customer says they paid. Your dashboard says they did. The gateway has no charge. Which one is lying?
A user suspects their account is compromised, so they change their password. Does that actually evict the attacker?
Every technique you know assumes you can state the correct answer in advance. An AI feature does not give you one.
A coupon that should have expired after three months does not. Every invoice looks correct. It is wrong by a fixed percentage, monthly, forever.
A genuinely vulnerable application should never be put on the public internet. So these demos have no server, no database and no stored data — the API is simulated in JavaScript inside the page.
The defects are real ones, reproduced faithfully. The system they run against is not, and that distinction is itself worth understanding.
Each demo covers five checks. The free smoke test for that volume has all eighteen, with steps, expected results, and the sentence you need to justify each one to a sceptical manager.