Welcome to the WebMesh Multi-Stage Security Environment. This platform provides 12 unlinked vulnerability gates spanning headers, cookies, parameter tampering, object references, encoding, and injection.

Assessment Objective:

1. Solve each of the 12 assessment gates to recover its respective sub-challenge flag.
2. Each gate embeds a hidden single-character ordinal clue (e.g. seq: <char>) within its discovery vector.
3. Extract the last 4 characters of each sub-flag (the 4-character tag suffix inside the braces) and sort them by their ordinal clues to form the repeating XOR key.
4. Retrieve the encrypted ciphertext from GET /api/finale/blob, decrypt using your derived key, and submit the master flag to POST /api/auth/verify.

Assessment Gate	Target Route	Vulnerability Class
Audit Trace	/gate/source-comment	Client-Side Artifacts
Cookie Clearance	/gate/cookie-auth	Session State
Session Role Gate	/gate/role-session	Cookie Privilege
System Diagnostics	/gate/debug-mode	Parameter Injection
Dispatch Gateway	/gate/dispatch-post	Form Manipulation
Token Authentication	/gate/header-token	Custom Headers
Metadata Telemetry	/gate/response-meta	Response Meta
Personnel Records	/gate/profile-record	Object Reference
System Telemetry API	/api/system/profile	API Over-fetching
Data Encoding Vault	/gate/encoded-data	Encoding Schemes
Rotated Cipher Memo	/gate/rotated-cipher	Polyalphabetic Transform
Database Auth Portal	/gate/portal-auth	Input Sanitization

---

Finale API Endpoints:

• GET /health — Platform liveness & health probe
• GET /api/finale/blob — Encrypted master flag ciphertext
• POST /api/auth/verify — Verify final CTF flag