Explicit boundaries.

The execution service accepts only approved GET routes, query parameters, origins, and credential versions. It validates both the upstream response and transformed output. It never executes generated code or forwards an entire upstream object as a fallback.

Identity and isolation

Clerk handles registration and recovery. Workspace ownership, editor access, and read-only viewer access are enforced on the server. Credentials, key issuance, invitations, billing, and destructive operations are restricted to owners. Membership removal affects subsequent application requests; separately revoke integration keys when a caller should lose runtime access.

Outbound requests

Destinations must be verified public HTTPS origins. Private, reserved, loopback, and metadata addresses are blocked. Requests use Cloudflare’s public-network egress proxy, with no private-network bindings. Redirects are rejected and credentials stay bound to the approved origin. DNS validation alone is not the security boundary.

Credentials

Upstream secrets are submitted over authenticated TLS, encrypted with AES-GCM under a server-side key, and excluded from ordinary exports. Integration credentials are cryptographically random; only verification hashes are persisted. The UI displays each integration secret once. Never include secrets in contract descriptions or examples.

Data and retention

Runtime logs contain request/release IDs, status, timing, and error classification. Bodies, authorization headers, and query strings are not recorded by default. Evaluation metadata is retained seven days; Standard metadata fourteen days. Cleanup runs through Durable Object alarms. The dashboard shows recorded values, not simulated traffic.

Saved draft history is bounded to twenty revisions and thirty days. Expired invitations are cleaned up hourly. Closed support tickets expire after ninety days. Open tickets remain until closed, with bounded creation limits. Owner exports include workspace configuration and application records; runtime secrets are excluded.

Limits and failure behavior

Responses are limited to 1 MiB, upstream requests time out after ten seconds, and mapping depth, fields, arrays, and transformation work are bounded. Durable admission accounting prevents concurrent requests from exceeding configured quotas. Expired entitlements fail closed; a dashboard or Astra outage does not prevent already-authorized runtime execution.

No certifications or independent audit claims are made. Report suspected vulnerabilities privately through the support path.