guest

Open Guest Workspace

Changed on

Mint one workspace for one stranger — NEVER ANY MORE.

Owner, 2026-09-25, after ~$5k went through our model key: "NO GUEST PLAY AT ALL … every person must sign in for real before ANY product use". The attacker minted 22 guest workspaces here (Turnstile unconfigured, the cap keyed on a spoofable header), each an owner with every capability. So the door refuses whatever the environment says, before it reads anything; the body below stays only until the guest machinery is taken out whole.

post/v1/guest/workspace

Request

  • Base URL: https://api.stormy.ai (the document declares no server; this is the origin it was published from)
  • URL: https://api.stormy.ai/v1/guest/workspace
  • Auth: none declared

Request body

namestring
originstring
turnstile_tokenstring
analytics_session_idstring uuid nullable
door_variantstring nullable
door_wordsstring nullable

Response

Successful Response

object required

Changes