This page describes implemented product boundaries. It does not claim a certification, independent audit, penetration-test result, or compliance status that is not published here.
Report a suspected vulnerability privately to [email protected]. Include the affected route or package, impact, and a minimal reproduction. Do not test against other customers or access data you do not own.
Opt-in external apps use OpenID Connect Code + PKCE, exact reviewed callbacks and app-specific user IDs. Apps receive no account password, account token, name or email. Protected requests must check current installation access; users can disconnect sessions. Availability is enabled separately in staging and production.
Customer and publisher operations require a short-lived account token, then enforce workspace membership, publisher ownership, installation scope, and role on the server.
The signed HTTPS adapter binds each invocation to a reviewed release and an Ed25519-signed envelope. The browser cannot supply a trusted endpoint, tenant, role, or permission set.
Only explicitly reviewed operations enter the public OpenAPI contract. Billing, administration, governance, and internal review operations remain in authenticated private documentation.
Anonymous and scoped experience routes have endpoint-specific request limits. Experience artifacts also have size, count, and per-session byte quotas.