Laboratory › Developers › Security

API security

The property that matters most here is not availability. It is that nothing private becomes public by accident, and that nothing public can be quietly changed.

Transport

• TLS only, HSTS with a two-year max-age and preload. There is no plaintext endpoint.
• Content-Security-Policy: script-src 'none' on every response. No page or document on this origin executes script, and the policy is served rather than assumed.
• X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, Cross-Origin-Opener-Policy: same-origin.
• Access-Control-Allow-Origin: * on /api. Everything is public; there is nothing a browser origin could be trusted with that it is not already entitled to.

Credentials

There are none, so the strongest statement this page can make is the accurate one: this API has no credential to leak. No endpoint accepts an Authorization header, no cookie is set, no session exists, and no example anywhere in this portal contains a secret — not even a fake one, because fake secrets in documentation are how real ones end up pasted into the wrong box.

When credentials exist, the rules on the keys page apply: never in a URL, never in a log, hashed at rest, shown once, scoped, expiring, revocable.

The public/private boundary

The authoritative scientific repository is private, and this site never reads from it. Publication is a one-way export with sanitisation, classification, secret scanning and licence review in between. There is no live connection to cross and no endpoint that proxies one.

Not exposed here, under any path: the private repository, protected confirmation material, service credentials, admin interfaces, private audit logs, provider or account configuration, unreleasable datasets, source paths, infrastructure topology, unpublished records, and any agent-control surface. A build test scans every emitted file for key material, tokens and local paths.

Request handling

There is no request-time execution, so there is no request parsing, no query interpretation, no template rendering and no database access to attack. Path traversal is rejected at the data layer — an artifact reference permits a flat file name with no separators and no parent references, enforced by schema and tested.

Integrity

• Every published claim version's digest is sealed; a published version that stops hashing to its sealed value aborts the build.
• Every artifact digest is re-derived from bytes at build time, and lengths are checked independently of digests.
• Every emitted file must appear in the build manifest.
• The same test suite runs against the deployed artifact, fetched back from the host, not only against the local build.

What is not claimed

No certification, no audit, no compliance attestation, no signing, no transparency log, no bug-bounty programme. Saying so is more useful than a badge.

To report a vulnerability, describe the class of problem in a challenge-shaped issue on the site repository. Please do not include working exploit detail in a public report.