CONTROL IS
BUILT IN LAYERS.
Implemented safeguards and the limits of this early-access workspace.
Implemented application controls
- Salted scrypt password hashes; passwords are not stored in clear text.
- Opaque session tokens stored as hashes; HttpOnly, Secure, SameSite cookies in production.
- Origin checks and per-session CSRF tokens for authenticated mutations.
- Owner-scoped queries for inspection records and images.
- Parameterized database statements and foreign-key cascading deletion.
- Image size limits and PNG, JPEG or WebP signature checks; SVG uploads are rejected.
- Account and image-storage preview quotas, and basic in-process request limits.
- Password-confirmed account deletion and password changes that revoke other sessions.
- One-time recovery-code rotation and session revocation on recovery.
- Database stored outside the public document root and versioned release.
Two evidence boundaries
The public demo is browser-local. The private workspace uploads and stores your images on Hostinger, accessible through authenticated application routes. Images are not sent to an AI model.
Not a certification
These controls do not establish a completed external security audit, SOC 2, ISO certification, immutable audit log, end-to-end encryption, guaranteed uptime or fitness for sensitive regulated data. In-process rate limits reset with the application. Email ownership is not verified and multi-factor authentication is not offered.
Operational limitations
Preview capacity is limited to 200 inspections and 50 MB of images per account, with a 5 MB per-image cap. No service-level agreement, automated backup-retention guarantee, incident-response deadline or disaster-recovery commitment is offered. Do not use the preview for safety-critical approval or confidential production material.
Report a concern
Use our responsible disclosure instructions. Contact the project owner privately; do not access someone else’s records or run disruptive tests.