Protect the public surface. Keep the engine private.

The website is a static public surface. It does not expose PBE or UCA source code, protected canon, internal receipts, credentials, or execution infrastructure.

Website controls

Static site with no database or user accounts
No public execution endpoint
No contact form or file upload
Restrictive browser security headers
Local-only boundary self-test

Responsible disclosure

Report a website security issue.

Email [email protected] with a concise description, affected URL, reproduction steps, and impact.

Do not access data that is not yours, disrupt availability, perform denial-of-service testing, or attempt to reach private systems through the public website.