No automatic URL access
Submitted locations are validated as untrusted text and never fetched by the server.
Security
Minimise first. Isolate always.
The enabled pilot is deliberately smaller than the intended product so unavailable controls cannot be mistaken for protection.
Scoped access
Case sessions are random, hashed in PostgreSQL and bound to one case.
Immutable corrections
New versions supersede old ones; stale tabs cannot overwrite accepted corrections.
No production email, uploads, partner transmission, billing, passkeys or public deployment is enabled.