Application security
- Server-only OpenAI, Supabase, and Stripe credentials are excluded from browser bundles and source control.
- Supabase tables use row-level security and explicit least-privilege grants.
- Stripe webhook signatures and payment amounts are verified before a listing changes.
- Submitted URLs are restricted to public HTTP or HTTPS targets, with DNS and redirect checks against private networks.
- Request limits, per-domain leases, and a database-enforced cooldown prevent duplicate AI work.
- Security headers reduce framing, MIME-sniffing, referrer, and unnecessary browser-permission exposure.
Data and AI isolation
Public website material is treated as untrusted evidence rather than model instructions. AI audit data and raw judge outputs are kept in private database tables; public browser roles receive only the fields needed for score pages, boards, and activity queries. Payment identifiers and management capabilities are never broadcast to public subscribers. Detailed analysis is kept separately from public numeric scores and requires a valid paid domain access key. Locked previews contain no hidden analysis text. Included listing updates verify the access key and chronological eligibility in a database transaction.
Responsible disclosure
Report a suspected vulnerability to support@startupbench.app with a concise description, affected URL, reproduction steps, and impact. Do not access other people's data, degrade availability, run automated high-volume scans, or publicly disclose an unresolved issue. Good-faith, limited research will be reviewed promptly.
Limitations
No security control can guarantee that unauthorized access is impossible. Practices and providers are reviewed as the product changes, and material incidents will be handled according to applicable notification duties.