Verify Security

No compliance certification and no formal SECURITY_REVIEW pass is claimed anywhere on this page. What follows is internal, source-level security testing performed by the engineering team building this product -- a real and meaningful check, but not the same thing as an independent security review, and it does not substitute for one before real customer data is processed.

Tested (automated, in this codebase)

• Cross-tenant access: a session, result, or credential created by one organization/project cannot be read, completed, or cancelled by another (automated tests + live route tests).
• IDOR: every session/result/checks/attempts endpoint re-checks tenant ownership server-side on every request, not just at creation.
• Webhook forgery and replay: HMAC-SHA256 signatures are verified constant-time, with a bounded replay window; a tampered body or wrong secret is rejected.
• Client-token scope: a short-lived hosted-flow token is bound to one session and one tenant, and rejected outside that scope or after expiry.
• Sandbox/production confusion: production execution fails closed everywhere it's reachable -- there is no code path where a sandbox result can be mistaken for a real one.
• Idempotency: a retried request with the same key returns the original result rather than creating a duplicate or double-counting usage.
• SSRF: webhook endpoint URLs are rejected for loopback, private-network, link-local and cloud-metadata addresses.

Not yet independently reviewed

• Evidence/log/secret leakage under a broader penetration-test style adversarial pass beyond the automated suite.
• Provider raw-payload leakage (no real provider is connected yet, so there is no raw payload to leak).
• Rate-limiting and abuse resistance at production scale.