SECURITY / TRUST

Public product.
Hostile-input mindset.

Mandorka treats public input as untrusted. Challenge integrity does not depend on frontend code, a hidden button or one CAPTCHA layer.

Server-only answer keys

The browser receives randomized task and option IDs, never the protected answer key used to score the session.

Single-use sessions

Each short-lived session can create one WorkProof. The database enforces a unique session-to-attempt relationship.

Randomized task bank

Each track has an eight-task bank and serves five randomized tasks per run, with shuffled options and opaque IDs.

Human verification

Cloudflare Turnstile is verified server-side with hostname and action checks before protected writes are accepted.

Rate + retake limits

Workers rate limits protect write endpoints; challenge starts also have D1-backed daily and per-track caps.

Origin and payload control

Production writes enforce canonical origin, content type, payload bounds and structured validation before application logic.

Session binding

Challenge sessions are bound to a pseudonymous request fingerprint and expire after 25 minutes.

Replay resistance

Atomic D1 writes and unique session IDs stop a completed session from becoming a second valid WorkProof.

Security headers

CSP, frame restrictions, MIME protections and related headers reduce browser attack surface while permitting required Turnstile resources.

WORKPROOF INTEGRITY

Verify the live record, not a screenshot.

Every WorkProof includes assessment version, score dimensions, integrity state and a SHA-256 fingerprint bound to the stored result.

Open Verification Center →

MANDORKA / TRUST CHECKSTRICT

answer key ............ server only
task selection ........ randomized
session ............... single use
expiry ................ 25 minutes
turnstile ............. server verified
origin ................ enforced
daily retakes ......... bounded
proof digest .......... result bound
public verification ... enabled

OPERATING PRINCIPLES

Fail closed

If required human verification or a security binding is unavailable, protected writes are rejected.

No security theater

Frontend checks improve UX; server and database controls decide whether a submission becomes authoritative evidence.

Version everything meaningful

Task or scoring changes create new assessment versions so old WorkProofs keep their original meaning.

Public product.Hostile-input mindset.