Pentest Report

Website security research and canon connections documented.

---

Summary

All "password protected" URLs were accessible without passwords. Website is canonically connected to the show via wacky-watch.c file in Episode 8.

---

Accessible URLs

Main Pages

• / - Main page (static/glitch state)
• /cainepaint - Caine Paint character creator

Voting Pages (16+ accessible)

• /vote1 through /vote41-1 - All accessible

Nominee Pages (7 total)

• /nominees-caine
• /nominees-gangle
• /nominees-jax
• /nominees-kinger
• /nominees-pomni
• /nominees-ragatha
• /nominees-zooble

Redirects

• /vote4 → /blank/gfdjflkdfjldkfj3l4kj23l
• /test → /blank/gfdjflkdfjldkfj3l4kj23l

---

Password Protection Bypass

Reddit Claimed: Vote pages were password protected Reality: ALL accessible without passwords

URL	Status
/vote1	200 OK
/vote2-1	200 OK
/vote3-1	200 OK
/vote5	200 OK
/vote41-1	200 OK

Conclusion: Protection was removed or never existed.

---

Technical Details

Property	Value
Server	Pepyaka (Wix)
Framework	Wix Thunderbolt v1.17066.0
Site Revision	449
Meta Site ID	a1cf4e21-d817-4499-bb28-a3068ac7f4ee
Site ID	97cca37d-dc5e-4379-8787-7c657a4685bc
User ID	b483616e-649c-444c-9898-e3d192b7eac9
Asset Prefix	b48361_

---

Archive History

Date	Content
Oct 9, 2023	First capture (redirect only)
Sep 26, 2024	First real content (Mildenhall era)
Nov 30, 2024	Spudsy's menu archived
2025	Award show era (vote pages)
Mar 2026	Current state (static/glitch)

---

Canon Connection Confirmed

Episode 8 terminal reveals wacky-watch.c exists in Caine's file system:

/secured/
├── caine-core.lisp [Oct 15, 1996]
├── paraphernalia-engine.dat [Oct 15, 1996]
├── [Scratch].dat [Oct 15, 1999]
├── [Ragatha].dat [Oct 15, 2008]
├── wacky-watch.c [Oct 15, 1996] ← THE WEBSITE
└── bubble-chef.lisp [Oct 15, 1996]

THE WEBSITE IS CANONICALLY PART OF THE SHOW.

---

Spudsy's Menu (Archived)

Item	Price	Notes
The Slab	$50	"Carefully curated human meat"
Dobby Dog	$57.57	Yellow dog = abstracted character
Vegan Meat	$70	Pickles
Sour Cream	$0.31	Left out 30 hours

Hidden: Exit door image links to Gooseworx Twitter post

---

404 URLs (Confirmed Non-Existent)

/admin, /api, /secret, /hidden, /debug, /dev
/caine, /pomni, /jax, /ragatha, /gangle, /kinger, /zooble
/bubble, /exit, /abstracted, /void, /circus, /adventure
/spudsys, /mildenhall, /game, /paint, /door
/job, /start, /57, /paraphernalia, /abstract

---

Wix Static Assets

Pattern: https://static.wixstatic.com/media/b48361_[hash]~mv2.[ext]

Examples discovered:

• b48361_0d6e99f1fcbb4eabaa8766cd53978774 - Glitch logo
• b48361_67690d55c473451b9cdafc062ad821e1 - Spudsy's menu item
• b48361_b4724c0f49c64e6d9219e600930019d8 - Exit door image

---

robots.txt

User-agent: *
Allow: /
Disallow: *?lightbox=
Disallow: /_partials*
Disallow: /pro-gallery-webapp/v1/galleries/*

User-agent: PetalBot
Disallow: /

---

Key Findings

1. ✅ All vote URLs accessible without passwords
2. ✅ Website is CANON via wacky-watch.c
3. ✅ Spudsy's menu has $57.57 Dobby Dog (57 reference)
4. ✅ Sitemap only shows 2 pages (others hidden from SEO)
5. ✅ Site in static/glitch state since March 2026
6. ✅ Archive.org has full history from Sep 2024