Skip to main content
Authority: Explanatory security profile · Status: Implemented candidate · Applies to: E2 · Verified against: current checkout · Source: internal/labapi, internal/origincatalog, lab/deploy
The client supplies only an origin identifier, operation identifier, and bounded typed values. Endpoint templates, HTTPS hosts, response limits, timeouts, attribution, replay fixtures, and rate limits are reviewed catalog configuration. The application enforces:
  • strict bounded JSON with duplicate-key and trailing-value rejection;
  • the reviewed HTTPS hostname enforced for the initial request and every redirect;
  • per-client, per-origin, and global concurrency limits;
  • no credentialed CORS, cookies, third-party scripts, or directory listing;
  • a loopback-only application listener behind Caddy;
  • manifest-last proof publication and symlink rejection;
  • hashed, process-local client identifiers in audit events;
  • a dedicated system user, read-only application tree, and one explicit writable result directory in production.
Application URL and resolved-address checks do not replace network isolation. Fresh external access still requires VPS egress policy, controlled DNS, metadata blocking, monitoring, and incident procedures. Submitted origin URLs are sent for human review and are never fetched automatically.
Last modified on August 10, 2026