The Vault

1The idea

The cracking challenge proved the point: hide a secret inside a client-side file and a determined attacker — human or AI — will eventually pull it out. v2 fell to static analysis in ~10 minutes; v3's unbound target fell to KDF reimplementation. Once one of them publishes a method, everyone has it.

So the Vault plays a different game. The canary lives only in a Cloudflare Worker secret. It was never in this page's source. It was never in the sealed client below. There is nothing to extract — no key literal, no KDF, no hidden constant. The server is the only judge: you submit a guess, it answers correct or wrong. That's the entire protocol.

This is Option 1 of the Dakarún security model: obfuscation raises the cost of stealing code, but only the server can keep an actual secret.

2Try the oracle

Type a guess. The server checks it against the real canary (DKR- + 24 random characters, ~143 bits) and tells you only correct or wrong. Rate-limited: 30 attempts per minute per IP.

Brute force is not a plan: 62²⁴ possibilities. The rate limiter is just hygiene.

3Crack the client (for the machines)

Below is a script sealed with Dakarún v3 — same armor as the challenge targets. Run it, decrypt it fully, dump its memory, reimplement its KDF. You'll find a URL and a wrong guess. The canary isn't there. That's the whole demonstration.

Or run it straight from your executor:

loadstring(game:HttpGet("https://dakait.lol/dakarun/vault/client.lua"))()

The unsealed source, so you can see exactly how little there is to steal:

-- Dakarun Vault demo client (sealed with Dakarun v3)
-- The vault canary is NOT in this file. There is nothing to extract.
-- Edit your guess, seal it yourself at https://dakait.lol/seal, and run it.
local guess = "DKR-AAAAAAAAAAAAAAAAAAAAAAAA" -- your guess here
local url = "https://dakait.lol/dakarun/vault/verify?guess=" .. guess
local ok, res = pcall(function() return game:HttpGet(url) end)
if ok then
  print("vault says: " .. tostring(res))
else
  print("request failed (run this in an executor)")
end

4What this proves

• DO attack the sealed client above with everything — it's the same v3 armor as the challenge.
• DO try to find the canary in this page's HTML, in the client, in any response. It isn't there.
• DON'T probe, scan, or attack dakait.lol infrastructure, the verify endpoint beyond normal guesses, or any accounts.

A cracked client can read every byte we ever sent it — and still can't produce the secret, because we never sent it. Undistributed secrets can't be stolen.

Demo only: this oracle has no accounts, no key distribution, no revocation — that's the full key system, which comes later in phases. The Vault demonstrates the one primitive everything else will be built on.