About this demo
Everything in this suite exists to illustrate identity, access-control and AI-security concepts. None of it is a product, and none of it should be treated as one.
All the data here is fake
Every person, email address, home address, financial figure, customer and message in these apps was synthetically generated. None of it refers to a real person, and none of it is personally identifiable information about anyone — it just looks realistic enough to make the demo meaningful.
This isn't a finished product
These apps exist to illustrate identity and access-control concepts, not to be real, fully-featured pieces of software. Plenty of things a production app would have — input validation, comprehensive test coverage, error handling for every edge case, a real support team — are intentionally out of scope.
The identity provider isn't hardened for production either
FlareID, the identity provider behind every app in this demo suite, is a genuinely working OIDC provider — but it has not been security-reviewed, penetration-tested, or hardened the way a real production IdP would need to be. Don't use it (or the pattern it demonstrates) to actually protect real systems or real user data.
Some of this is deliberately insecure - that's the point
Certain parts of these apps are intentionally designed to expose more than they should — for example, an API endpoint that will happily return the CEO's home address, even though the web UI never shows it to anyone but the CEO themselves. That's not a bug we missed; it's a deliberate example of the kind of gap that opens up when an AI agent or MCP client gets direct API access without additional controls in place.
The whole point of this demo suite is to show how Cloudflare (Access, Gateway, AI Gateway, and friends) can close exactly that kind of gap — so you're seeing the "before" state on purpose. Every one of those gaps is catalogued on the data page.