What operates today
The public website is hosted through Cloudflare. Account sign-in, profile settings, saved requests and API key management are available. Session-protected account routes enforce tenant ownership; API key secrets are displayed once and stored as hashes. Job Search API, credit purchases and authorized result downloads are available. Public interactive examples run locally in the browser. Optional Google Analytics follows the website privacy notice and is not loaded on workspace pages; Cloudflare’s cookie-less Web Analytics beacon is served on every page, including the workspace.
API controls
Task and result access requires authentication and enforces tenant ownership. API keys support scoped access, revocation and spending limits. API keys must not appear in URLs, public examples or support messages. We do not claim a completed penetration test or security certification.
Results are stored privately in Cloudflare R2 until the task’s resultExpiresAt, normally seven days after completion. Authorized downloads use short-lived signed links. Billing, security, recovery and backup records can outlive result expiry. See data practices and service providers for the current boundary.
Report a vulnerability
Email [email protected] with the affected URL, a concise description and minimal reproduction steps. Use a subject beginning with “Security report”. Do not send passwords, API keys or another person’s private data; redact any accidentally exposed material.
Do not access other users’ data or disrupt the service to demonstrate a finding. We do not currently publish a bounty program, guaranteed response time or contractual security SLA. General product questions belong on the contact page.