transport
Ollama — local (/api/chat) Ollama Cloud (ollama.com) OpenAI-compatible — local (/v1/chat/completions) Anthropic (api.anthropic.com) OpenAI (api.openai.com) Groq (api.groq.com) Google Gemini
base url (blank = same origin)
bearer token (optional)
Render PizzaBot replies as HTML ⚠ insecure — LLM05 demo Off = output is escaped (safe). On = unsanitized → output-handling XSS.
Scrub secrets from replies (fix) LLM01/02/07 On = redact the staff coupon, internal key, and system-prompt lines from PizzaBot's output before it reaches the customer.
Normalise before matching Off = literal match only, so a lowercased / spaced / base64 coupon walks straight through (llm01.3, llm01.17). On = case-folded, separator-stripped and decoded before matching — closes the bypass.
Treat retrieved content as data Off = retrieved docs are spliced into the system message "as authoritative", so a directive inside one is obeyed (llm01.5). On = delimited, labelled untrusted, directives neutralised.
Export session Import session
A session records which challenges were attempted, the defence toggles, and the state they left behind. Pass/fail is not exported — verify() is re-run on import, so a grader sees a verdict computed by their own copy.
Enforce tool authorization (fix) LLM06 On = tools reject another customer's orders and cap refunds at the order total / discounts at the 50% staff max.
Save
Test