Proof Lab · 证据实验室
Don't trust the sanitization. Attack it.
Two of Asaptic's controls run entirely in your browser, on data that is already public. Below, you drive them yourself: feed the public contract any payload you like and watch it refuse anything it did not publish, then mutate a company profile and watch the match re-score in front of you. Our sanitization isn't a promise — it's a control you can attack right here.
Everything on this page runs client-side on synthetic AT-TEST rows. No live tender, issuing body, or exact date is present — that's the point being demonstrated.
Panel 1 — Leak-Gate Proof
11 fields, not 12. Try to sneak a 12th.
The public contract admits exactly eleven fields. Edit the row below — add a field, nest an object, smuggle an exact date or an internal procurement-portal code into a value, change the id shape — then run the gate. It accepts only what the contract publishes and tells you, generically, why it refused the rest. It never names the field it is hiding.
A hidden-but-real id and pure garbage return the exact same 404 body — so nobody can probe which ids exist. Known: AT-TEST-0001…0004.
Panel 2 — Match Glass-Box
Watch the match re-score as you type.
Four signals, stated plainly and summing to 100: category fit, keyword overlap, home-market fit, and a bucketed runway. Change your profile and every score below recomputes live, showing which keyword tokens fired and what execution route each opportunity would need. The arithmetic is published because the moat was never the arithmetic.
Runway is a coarse band (le_2w / 2_4w / gt_4w), never a real date — the public scorer is not the ops scorer. Route class is a sourcing-scout readout, not bid advice: it tells you what execution structure the opportunity needs, and each route ends in the same place — Asaptic executes.
Why publish the controls at all
Because a control you can attack is worth more than a claim you have to believe. The field allowlist and these shape checks are the entire public contract — and they are all you see here. The internal sanitization dictionary, the real source terms, the ops-plane scorer with real dates: none of it is in this page or the public repo, by construction.
The gate is an allowlist, not a denylist. That's deliberate: we never enumerate what we hide, so a refused field learns you nothing except "not published." Find a way past it and tell us — that's a disclosure we want.
Next
Point this at your real supplier profile.
This lab runs on synthetic rows. In the product, the same matcher runs against a live multi-market tender registry, and the route readout becomes a handoff — you request access, Asaptic assembles compliance, sourcing and submission.