Current preview safeguards
The demo executes in browser memory and exposes no AI credentials, upload endpoint, payment form, database or hardware connection. Downloads are local. Contact buttons open your email app; the website does not transmit the message.
- HTTPS is provided by the deployment host.
- The application sets frame, content-type, referrer and permissions headers.
- External fonts, advertising pixels and optional analytics are not loaded.
Responsible AI boundaries
Future AI output must be treated as a proposal. Datasheet grounding, electrical checks, build checks and human approval are separate steps. No generated design should be labeled tested without recorded tool or physical evidence.
Production security plan
Planned controls include per-tenant authorization, scoped MCP tools, isolated job execution, encrypted storage, secrets management, audit history and revision-bound approvals. These are design requirements, not claims of controls already deployed in this preview.
Report a concern
Email hello@arcarix.com with the subject “Security report”. Include the affected URL, a description and safe reproduction steps. Do not access other people’s data or disrupt availability. No bug bounty, response-time SLA or security certification is currently offered.