Application security
- Server-only OpenAI, Supabase, and Stripe credentials are excluded from browser bundles and source control.
- Supabase tables use row-level security and explicit least-privilege grants.
- Stripe webhook signatures and payment amounts are verified before a listing changes.
- Submitted URLs are restricted to public HTTP or HTTPS targets, with DNS and redirect checks against private networks.
- Request limits, per-domain leases, and a 24-hour website cooldown prevent duplicate AI work. Fixed input, output, call-count and concurrent-run limits are backed by a shared spending circuit breaker.
- Security headers reduce framing, MIME-sniffing, referrer, and unnecessary browser-permission exposure.
Data and AI isolation
Public website material is treated as untrusted evidence rather than model instructions. AI audit data and raw judge outputs are kept in private database tables; public browser roles receive only the fields needed for score pages, boards, and activity queries. Payment identifiers and management capabilities are never broadcast to public subscribers. Detailed analysis is kept separately from public numeric scores. A bounded preview of one strength, one improvement and one criterion is public; the rest requires a valid paid domain access key, except StartupBench’s own public example. Removing the blur reveals only placeholders, not the locked report. Included listing updates verify the access key and chronological eligibility in a database transaction.
Responsible disclosure
Report a suspected vulnerability to support@startupbench.app with a concise description, affected URL, reproduction steps, and impact. Do not access other people's data, degrade availability, run automated high-volume scans, or publicly disclose an unresolved issue. Good-faith, limited research will be reviewed promptly.
Limitations
No security control can guarantee that unauthorized access is impossible. Practices and providers are reviewed as the product changes, and material incidents will be handled according to applicable notification duties.