Skip to content
Security & trust

Built to inspect websites without becoming careless with data.

SchemaCraft is designed around least-privilege access, server-side safeguards, explicit plan boundaries and a clear distinction between evidence and AI-generated recommendations.

Access control

Authenticated product workflows use account-level access and server-side plan checks for protected capabilities.

Agency-only workflows are gated server-side
Saved projects are scoped to the authenticated owner
Checkout targets are allow-listed

External fetch safety

Website inspection and monitoring are treated as untrusted network operations rather than unrestricted fetches.

HTTP/HTTPS validation and redirect limits
Timeout and response-size controls
SSRF-oriented DNS and private-IP safeguards

Data boundaries

Product telemetry is designed around coarse workflow events instead of storing raw customer pages or generated content as analytics payloads.

Telemetry is non-blocking
Payloads are size-capped
Business-critical outcomes can be recorded server-side

What we optimize for

Trust should come from the architecture, not a badge.

The product avoids presenting AI confidence, an audit score or a technical comparison as proof of a business outcome. Verification is positioned as evidence that a requested implementation change was observed in production.

Evidence over claims

Results distinguish observed checks from predictions and recommendations.

Least privilege

Protected product operations are scoped to the authenticated user and plan.

Safer crawling

External website fetching uses bounded network behavior and abuse controls.

Controlled data

Telemetry and stored workflows are intentionally constrained to defined product needs.

Authentication

Account access uses Supabase Auth with magic-link login in the current product experience.

Rate limiting

Server endpoints use distributed rate limiting rather than relying only on in-memory process state.

Plan enforcement

Protected Agency and Pro capabilities are enforced by server-side entitlement checks, not only UI visibility.

Security copy describes current product controls and is not a certification, regulatory guarantee or contractual SLA.

SchemaCraft

Website intelligence, structured data and verified technical workflows.