Implementation overview
Security
This page describes safeguards visible in the current code and deliberately does not claim unimplemented controls.
Implemented boundaries
Authenticated workbench routes are protected through the platform-provisioned authentication middleware. The public evaluator is non-executing. Gateway decisions are designed to fail closed, and REFUSE never produces an execution-authorized directive. Admin token redirects remove the token from the URL after setting an HttpOnly secure production cookie.
Not claimed as live
The repository does not by itself prove email verification, password reset, session revocation, account deletion, CSRF protection, rate limiting, a formal security certification, external monitoring, or a completed OWASP assessment. These controls must not be represented as live until implemented and tested.
These are interim notices based on the deployed application's visible implementation. Owner-controlled legal details remain pending. See required legal inputs.