Built to inspect websites without becoming careless with data.
SchemaCraft is designed around least-privilege access, server-side safeguards, explicit plan boundaries and a clear distinction between evidence and AI-generated recommendations.
Access control
Authenticated product workflows use account-level access and server-side plan checks for protected capabilities.
External fetch safety
Website inspection and monitoring are treated as untrusted network operations rather than unrestricted fetches.
Data boundaries
Product telemetry is designed around coarse workflow events instead of storing raw customer pages or generated content as analytics payloads.
What we optimize for
Trust should come from the architecture, not a badge.
The product avoids presenting AI confidence, an audit score or a technical comparison as proof of a business outcome. Verification is positioned as evidence that a requested implementation change was observed in production.
Evidence over claims
Results distinguish observed checks from predictions and recommendations.
Least privilege
Protected product operations are scoped to the authenticated user and plan.
Safer crawling
External website fetching uses bounded network behavior and abuse controls.
Controlled data
Telemetry and stored workflows are intentionally constrained to defined product needs.
Authentication
Account access uses Supabase Auth with magic-link login in the current product experience.
Rate limiting
Server endpoints use distributed rate limiting rather than relying only on in-memory process state.
Plan enforcement
Protected Agency and Pro capabilities are enforced by server-side entitlement checks, not only UI visibility.
Security copy describes current product controls and is not a certification, regulatory guarantee or contractual SLA.