Implemented controls
Browser review runs locally, treats cells as text and protects CSV exports from formulas. The app validates public enrichment destinations, verifies TLS and bounds SMTP connections and responses. New jobs use per-record authenticated Fernet checkpoints and validate input/configuration on resume. The AI adviser executes neither shell nor dataset instructions.
Keys and deployment
Checkpoint keys are stored separately; anyone with both files can decrypt the data. Protect permissions, backups and device encryption. The prepared gateway uses a token, request/concurrency limits, a fixed model and Caddy HTTPS. Compose exposes no public Ollama port. Rotate secrets, preserve TLS and validate the actual server before serving users.
Known limits
Input/output CSV files are not encrypted by checkpointing. The legacy workflow can keep an unencrypted cache. Gateway tokens are shared: no multi-tenant identity, per-customer quotas, SOC 2 or ISO certification is claimed. Automated tests do not replace an infrastructure audit or real delivery benchmark.
Responsible reporting
Report vulnerabilities to legal@alicelabs.site with reproduction steps and minimal necessary data. Do not publish secrets or other people’s data. This channel promises no bounty, fixed resolution deadline or exemption for unauthorized actions.