SECURITY / OPERATIONS

A conservative boundary around a public-records graph.

The site ships with host allowlists, same-origin mutations, bounded API bodies, and CSP. Catalog data comes from official US public records (USAspending and SAM.gov), not scraped social graphs.

Request boundary

Host allowlist, same-origin checks, and bounded JSON bodies

Catalog boundary

Public USAspending contract records and SAM.gov notices, each with a source URL

Deployment boundary

Secrets stay server-side; D1 and R2 bindings are explicit

RESPONSIBLE DISCLOSURE

How to report a problem

Include the affected route, reproduction steps, impact, and a safe contact method. Do not include real credentials or personal data.

Security contact: security@rostely.com. Machine-readable policy: security.txt.