Security
Checked in the open.
What protects this site, the tools and the receipt contract, stated as it is today. Run the public scanners yourself once the domain is live.
In the code
What the code guarantees.
Properties you can confirm in the source.
No keys on our side
The site never asks for a seed phrase or a private key. Signatures and transactions happen in your wallet.
Read-only relay
The chain relay forwards only read methods to a short allowlist, caps sizes and rate-limits every network. Signed transactions are never relayed.
Runs stay with you
Plans, outputs and history live in your browser. The server stores no runs and keeps no request logs of them.
Approval for actions
Saving, copying and signing stop for your decision. No tool can move funds.
Owner-free contract
CortiqRunReceipt has no owner, admin, fee, pause or upgrade path, and holds no funds. It is deployed and its bytecode can be matched with npm run verify-deployment.
Optional AI, capped
When enabled, the AI planner receives only the task text, its model is checked against a price ceiling on every call, and calls are limited per network and per hour.
The setup
What is set on every response.
- X-Frame-Options
- DENY
- X-Content-Type-Options
- nosniff
- Referrer-Policy
- strict-origin-when-cross-origin
- Permissions-Policy
- camera, mic, location off
- Trackers / ads
- 0
- Third-party scripts
- None
Scans
Run them yourself.
Results appear once cortiq.site serves this site; we do not quote grades we have not seen.
Security headers
Response headers such as content type options, framing and referrer policy. Run the test
- Result
- —
The scanners above test the website only. Runs and receipts are explained on the how-it-works page, and weakness reports go through the contact page.