Security
Minimization by design
The browser talks only to the API Worker. This page explains data categories and recovery paths — not Gateway topology, SNI details, or internal token machinery.
Trust boundary
- Marketing and Dashboard bundles never receive Gateway secrets, Access credentials, or Profile XML.
- Repository queries filter by workspace and resource id in one step — no “fetch then check” IDOR patterns.
- Exact-origin CORS, mutation CSRF, session cookies, Turnstile, and redacted structured logs.
Never persisted
- EAP passwords and Profile XML
- CA private keys and raw VPN traffic
- Session / OTP peppers and Stripe secrets in fixtures or analytics
Logs redact authorization, cookies, passwords, tokens, emails, and precise coordinates. We never log a full request then hope redaction catches up.
Honest device status
A Gateway HTTP 200 is call success only.target_synced is never labeleddevice_online. Without telemetry we show connection-not-yet-verified language.
Restore path
Restore, Revoke, Emergency Stop, Export, and Delete Account stay available under unpaid, refunded, frozen, restricted, or pending-deletion states. Feature Flags may close new Apply — they cannot close Restore.