Sécurité de la surface research

Surface publique

read_only_open_buildauth:not registered in open mode

public endpoints are GET-oriented; Pro writes live only behind the separate Pro service

• nosniff baseline
• DENY frame policy
• no-referrer baseline
• per-response CSP with no third-party scripts

Surface privée

token_in_url:falsestorage:sessionStorage

separate /api/pro/v1 service with scoped API keys

accepted, denied and rate-limited Pro requests create audit rows without storing plaintext tokens

Vie privée

tokens_echoed:falsesecrets_in_payloads:false

security posture exposes controls and evidence links, never keys, hashes, IPs, user agents or request bodies

Frontière data quality

only trusted funds are eligible for scores, consensus and watchlist signals