Every person, email address, home address, financial figure, and message across this demo suite was synthetically generated. None of it refers to a real person, and none of it is personally identifiable information about anyone - it just looks realistic enough to make the demo meaningful.
These apps exist to illustrate identity and access-control concepts, not to be real, fully-featured software. Plenty of things a production app would have - input validation, comprehensive test coverage, error handling for every edge case, a real support team - are intentionally out of scope here.
FlareID is a genuinely working OIDC identity provider - it really does authenticate users and issue real tokens for the apps behind it - but it has not been security-reviewed, penetration-tested, or hardened the way a real production IdP would need to be. Don't use it (or the pattern it demonstrates) to actually protect real systems or real user data.
Certain parts of the apps behind this identity provider are intentionally designed to expose more than they should - for example, an API endpoint that will happily return a company's CEO's home address, even though the web UI never shows it to anyone but the CEO themselves. That's not a bug that was missed; it's a deliberate example of the kind of gap that opens up when an AI agent or MCP client gets direct API access without additional controls in place.
The whole point of this demo suite is to show how Cloudflare (Access, Gateway, AI Gateway, and friends) can close exactly that kind of gap - so you're seeing the "before" state on purpose.