TRUST // SECURITY
The boundaries protecting the AGI site's public forms and the separate NOISE system.
The AGI site is a separate public website with server-side email forms. It does not receive or store Google Search Console OAuth tokens, does not share NOISE credentials or MCP data, and does not modify the existing NOISE product or data path.
Every form route validates the trusted origin and a strict schema on the server, enforces email and input-length limits, escapes HTML, blocks header injection, checks a honeypot and submission timing, and applies best-effort per-instance rate limiting. Public errors are generic; operational logs record event and failure categories without form contents, email addresses, or secrets. The rate limit is not globally persistent across serverless instances.
V1 accepts URLs rather than uploads. The server does not fetch arbitrary submitted URLs. User input is never executed or automatically published as MDX, HTML, script, or code.
Report a suspected vulnerability privately to hello@navines.com with “Security” in the subject. Do not include secrets in the initial message or access data beyond what is necessary to demonstrate the issue.
LAST UPDATED // 2026-08-28