Security & data boundaries

Small data surface, visible boundaries

Source discovery runs on-device. Confirmed evidence is limited to known signals and file locations. The local API uses loopback binding, strict input schemas, request-size limits and Host/Origin checks. Those controls do not replace production authentication.

Server-only provider access

The optional Vercel adapter accepts a scoped integration credential through local OAuth or the API process environment. OAuth exchanges a one-time code at Vercel’s fixed token endpoint and retains the token only in server memory. It permits only a fixed deployment-list GET endpoint, rejects redirects, validates responses and applies request limits. Tokens are never entered in the browser or saved to inventory. The operator must verify grants; scope introspection and hosted OAuth are not implemented.

Hosted connectors still require tenant isolation and managed credential protection. A plugin label or an MCP read-only hint does not establish safe access.

Historical snapshots

The snapshot contract allows normalized aggregate values and provenance. It rejects arbitrary raw payload fields. Authenticated collection, database persistence, retention enforcement and report access controls still need implementation.

Before hosted launch

Required work includes authentication and tenant isolation, credential encryption and revocation, tested backups and restore, retention deletion, rate limiting, monitoring, incident response and security review.

An edge provider such as Cloudflare may provide TLS and traffic protections. Edge-to-origin encryption, origin access controls and application security must also be verified. No Cloudflare deployment, SLA, SOC 2, ISO certification or compliance audit is claimed.

Report a concern

See Contact & support for current private contact availability. Please avoid including credentials or private records in an initial report.