EmbedHarborClear boundaries for sensitive product data.
Know what is local, what is synthetic and what the existing services actually do.
New prototype tools
SBOM structure checks and firmware hashing happen in the browser. No file bytes are uploaded by these tools. Saving explicitly retains derived results and metadata in this tab’s sessionStorage, not a production account. Reset the demo in /app/settings or close the tab.
Existing authenticated services
The separate live account workspace uses account-scoped product storage and HttpOnly sessions. Its OSV scans send supported package names, ecosystems and exact versions to OSV. These existing services are not invoked by the prototype workflows.
What the prototype does not prove
Synthetic advisory reviews are not CVE detections. File hashes are not firmware component identification. Evidence presence is not legal sufficiency. Generated prototype drafts are unsigned and not regulatory submissions.
Production work remains
Verified email, public deployment controls, retention enforcement, backups, account deletion, quotas and production cross-domain result claiming require their own implementation and validation.