I spent an afternoon wandering through hego.red/jackpot and it's the kind of thing that makes you grin like a kid with a chemistry set. No login, no setup — just ten tiny apps that happily do exactly the wrong thing.
The whole thing runs client-side in your browser, which itself is kind of brilliant. You're not hitting some server that logs your prompts or rate-limits you. You just open dev tools, swap a token, flip a config flag, or feed the model a slightly tweaked prompt and watch it bend.
A few that stuck with me:
Prompt Injection playground— a fake chatbot that reads a "secret" instruction file and cheerfully ignores it if you phrase your input just right. It's like watching a bouncer get distracted by a distraction.Insecure Deserialization demo— an app that takes user JSON and shoves it straight into an eval-like flow. Spoiler: it doesn't end well for the app.** Overly permissive tool use**— a mini agent that'll call tools based on whatever you type, including ones it probably shouldn't. Watching it try to "help" by escalating its own permissions is both funny and unsettling.
What I like is that it's not lectureware. There's no preachy banner telling you "this is bad." You just poke and the app breaks. The learning is incidental — which is exactly how it should be for this crowd.
The source links lead to a GitHub repo with writeups for each app, so you can go read about the intended vuln after you've already found three other ways to break it. That's the real charm: it invites you to fail, then explains why you failed.
If you're into prompt engineering as a hobby, or you're building LLM workflows and want a gut check on what "bad" looks like, this is a solid hour of messing around. I walked away with a better feel for how easily these things collapse when the guardrails are just suggestions.
The link: [hego.red/jackpot](https://hego.red/jackpot)
No sign-ups, no warnings, no hand-holding. Just ten apps waiting to be embarrassed.
Next OWASP Agentic Supply Chain: Part 5 Deep Dive →