Security

Current access

The public proof of concept is available without an account or sign-in. The application has no end-user accounts, registration flow, password store, or authenticated-user database.

Human verification

Generation requires server-validated Cloudflare Turnstile before a research run can start. The browser retrieves the public widget configuration at runtime and presents the check in the form. The server checks the token, hostname, action, expiry, and single-use result before any OpenAI request.

API credentials

The OpenAI API key is stored as a server-side Sites secret. Research requests reach OpenAI through the application server. The key is not intentionally placed in browser code, page HTML, local storage, generated kits, or API responses.

Request protection

• Generation accepts same-origin JSON requests with an 8 KB body limit and bounded field lengths.
• Sales methods and deliverables are restricted to explicit allowlists.
• Submitted URL-like values reject credentials, unsupported schemes, private or reserved literal addresses, and nonstandard ports.
• The application does not directly fetch the submitted brand or product URL. Public retrieval is delegated to the provider's web-search tool.

Abuse and cost controls

Production controls permit no more than 20 starts per client in ten minutes, 100 starts per day, and five concurrent runs. Every run has a unique request identifier, replay protection, job authorization, bounded polling, a fixed model budget, and an operational pause control.

Operational records

The database stores request identifiers, provider job identifiers, job status, timestamps, usage counters, and any read-only kit snapshot a user explicitly creates with Copy link. Shared snapshots use random 128-bit identifiers, are rate limited, and expire after 30 days. Client rate-limit buckets use a daily SHA-256 hash of the requesting IP address. The application does not write the raw IP address to that database.

Generated content

React escapes rendered text by default. Generated external links are accepted only when they resolve to public HTTP or HTTPS URLs. Source-backed facts remain separate from account hypotheses, and unsupported conditions must remain questions or evidence boundaries.

Browser storage

Generated kits and display preferences are stored in local browser storage and do not synchronize across browsers or devices. A server-side kit snapshot is created only when a user selects Copy link.

Browser safeguards

The application sends a restrictive content-security policy, frame denial, strict transport security, content-type protection, a same-origin opener policy, a restrictive referrer policy, and a limited permissions policy.

Limitations

This proof of concept has not completed an independent penetration test, SOC 2 audit, or formal security certification. Confidential, regulated, customer-controlled, credential, payment, or special-category personal data should not be submitted.