An update on the red-team

An update on the red-team loop from my last post.

I turned it from a one-off script into a real harness I run with one command against the whole stack. It attacks the backend, replays out-of-order Stripe events to prove a cancelled plan can't come back, and it screenshots the site and fails if the page renders as a flat white frame. That last one is a real bug I hit: the old checks passed because there were no console errors, but the entire hero was painting white on certain GPUs.

I also added a tripwire that fails the build if I ever delete something already built and verified, or reintroduce a mistake I already fixed. Iterating on a live 3D site, the hard part is not breaking the thing that already worked.

It runs in CI now, so every push gets checked.

Live: xkaii.studio Security: xkaii.studio/security