Security is a product boundary

Trust comes from controls you can verify.

SRC Launch separates public discovery, customer data, operations, providers, secrets, and AI tools. The local mission validates the architecture while production services remain credential-gated.

⌾Local security posture

SANDBOX TESTED

Production penetration testing, malware scanning, email, storage lifecycle, and managed identity configuration remain staging boundaries.

Identity protection

Strong password rules, sandbox email verification, rate-limited sign-in, HttpOnly SameSite sessions, and mandatory Owner MFA.

Server authorization

Customer isolation and Owner permissions are enforced in data operations—not inferred from hidden buttons.

Private document vault

R2 object keys are non-public, ownership is checked server-side, downloads are private, and MIME, extension, name, and size are validated.

Operational secrecy

Customer outputs exclude provider wholesale cost, margin, internal notes, other customers, and unrestricted data access.

AI boundaries

Approved knowledge produces grounded answers; unsupported questions escalate instead of inventing law, tax, approval, or account outcomes.

Discoverability separation

Public metadata and structured content never expose dashboards, KYC, documents, sessions, or Owner routes.

✓IDOR / customer isolationControl reviewed locally

✓Broken authorizationControl reviewed locally

✓XSS and unsafe CMS HTMLControl reviewed locally

✓CSRF / cross-origin mutationControl reviewed locally

✓SQL injectionControl reviewed locally

✓Path traversalControl reviewed locally

✓Open redirect loopsControl reviewed locally

✓Brute force / enumerationControl reviewed locally

✓Malicious uploadsControl reviewed locally

✓Webhook spoofingControl reviewed locally

✓Wholesale-price leakageControl reviewed locally

✓Prompt injection / AI leakageControl reviewed locally

Report a security concern

A production security contact and coordinated disclosure address must be configured by the Owner before public launch. Do not submit sensitive evidence through a public form.

Next step

Build your launch plan with clarity.

Check your readiness, compare the supported states, or speak with SRC Launch before making a decision.

Check readiness ↗Talk to us first →