Website
- Static site: no server-side code, accounts or database.
- Content-Security-Policy: scripts only from the site’s own origin; network access limited to the listed read-only APIs.
- No wallet connection, no transaction signing, no seed phrases — ever.
- All user-supplied input (passports, share links, benchmark files) is size-limited, strictly parsed and rendered as text.
Connectors and future services
- No credentials in the browser; provider secrets stay server-side.
- Rate limits, abuse protection and audit logs on every endpoint.
- Explicit per-job consent for anything that costs money.
Reporting a vulnerability
A security contact will be published in the Trust center. Until then, use the contact form with the topic "Security report".