Minimise
Do not collect accounts, payment data, uploads, or live AI prompts before the product has a justified need and a protected handling path.
CURRENT SECURITY POSTURESecurity without
Security without
theatre.
Boardesa AI is a static product preview with a local workspace. This page separates controls that exist today from safeguards required before live AI, accounts, uploads, or billing can launch.
No public bug bountyNo frontend secretsNo live AI backend
BOARDESA SECURITY
- Content policy
- STRICT CSP
- Build assets
- HASHED + SRI
- Workspace transport
- LOCAL ONLY
- Portable sessions
- SHA-256
- Frontend credentials
- NONE
These labels describe the deployed static preview. They are not a penetration-test certificate or a guarantee that every vulnerability has been found.
CSP ENFORCEDSRI VERIFIEDSAME-ORIGIN CACHEANALYTICS BY CONSENT
Security methodReduce exposure
Reduce exposure
before adding capability.
The current product intentionally keeps the attack surface smaller while its future backend, data, identity, and payment boundaries are designed.
Isolate
Keep future provider credentials and payment secrets on protected server infrastructure, never inside public HTML or JavaScript.
Verify
Bind requests and responses, validate portable sessions, verify content-hashed assets, and reject unexpected transport or cache content.
Disclose
State inactive services, known limits, reporting routes, and launch gates without inventing certifications, uptime, or security guarantees.
01Controls active now
Static delivery with
explicit boundaries.
These controls are present in the deploy package and can be inspected without trusting marketing claims.
Content Security Policy
Scripts and styles are limited to known origins, inline event handlers are blocked, framing is denied, and active content is not loaded from arbitrary CDNs.
Hashed assets and SRI
Production CSS and JavaScript use content-derived filenames and Subresource Integrity values checked against the deployed files.
Validated same-origin cache
The service worker accepts only allowlisted routes and current-build assets with expected origin, status, and MIME type.
Portable integrity checks
Local recovery files include a SHA-256 digest and strict size, schema, age, allowlist, and content-length validation before import. Current files add an integrity-covered export ID so exact replay can be labelled and a previously seen ID with a different fingerprint can be blocked in the current tab. This does not authenticate the author.
Consent-first analytics
Google Analytics remains denied until the user explicitly allows it. No advertising storage or AdSense integration is active.
Local-only workspace
URL parameters and imported files cannot activate a model provider, remote endpoint, account, upload, or payment flow.
Responsible reportingReproduce carefully.
Reproduce carefully.
Share only what is needed.
Use ordinary email for a concise, redacted report. Stop testing if an action could expose another person’s information, disrupt availability, alter data, or create avoidable cost.
INCLUDE
- Affected URL and visible build ID
- Concise impact and prerequisites
- Minimal reproducible steps
- Observed and expected behaviour
- A redacted example when useful
DO NOT INCLUDE
- Passwords, API keys, or payment data
- Private student or identity records
- Data belonging to another person
- Unnecessary full session exports
- Public exploit details before review
Review pathA clear process,
A clear process,
without a false SLA.
Security messages are reviewed through email. Boardesa does not promise a bounty, guaranteed response time, or encrypted reporting channel in the current preview.
Receive
Confirm whether the report concerns the current public build and contains enough redacted detail to reproduce safely.
Reproduce
Validate the behaviour in an isolated environment without using another person’s data or widening the impact.
Contain
Remove or disable an affected path when needed, then correct the underlying code, configuration, or documentation.
Communicate
Update the reporter when practical and revise public security or status information when a material boundary changes.
Before live servicesSecurity must grow
Security must grow
with the attack surface.
Connecting live AI, uploads, accounts, or billing requires controls that a static preview does not yet need.
- Server-only secretsProtected provider and payment credentials with independent server validation.
- Identity and authorizationSession security, account recovery, access boundaries, and abuse resistance.
- Rate and cost controlsPer-user limits, idempotency, provider failover, budget ceilings, and safe retries.
- Data and incident mapRetention, deletion, logging, provider processing, rollback, and incident ownership.
- Payment isolationHosted payment handling, webhook validation, entitlement checks, and refund rules.
Known limits
What this page does not claim.
No certification. This is not a security certification or penetration-test report.
No bounty promise. No reward, response-time, or remediation-time commitment is offered.
No encrypted mailbox. Reports must be minimised and redacted.
No live-service coverage. There is no public AI backend, account platform, upload processor, or payment system.
Security questionsClear boundaries
Clear boundaries
for responsible reports.
Does Boardesa AI have a live AI backend today?+
No. The current workspace is a deterministic local preview.
Does Boardesa AI offer a bug bounty?+
No public bug bounty is offered. Responsible reports are welcome by email.
What should a security report include?+
Include the affected URL, build, impact, reproducible steps, expected and observed behaviour, and a redacted example.
Can an imported session enable a provider?+
No. The transport is fixed to local preview.
Is encrypted security email available?+
Not currently. Do not include secrets or unnecessary personal data.
Report responsiblyUseful evidence.
Useful evidence.
Minimum exposure.
Start with the published policy and a redacted reproduction. Use Help Center for ordinary recovery issues.