Security

Last updated: 2026-09-23 · Product: Maintenance Tech Desk

Controls (current DRAFT deploy)

• TLS via Cloudflare; HSTS enabled on Worker responses
• Security headers: CSP, nosniff, frame deny, Referrer-Policy, Permissions-Policy, COOP
• CORS allowlist (fielddesk, mtd, mtdesk, workers.dev) — no wildcard
• Shop key via X-MTD-Key only (query-string keys rejected)
• Timing-safe shop key compare; rate limits on /api/ask and auth failures
• JSON body size limit (~32KB); ask length capped
• Refuse engine for auto-buy, license stamp, life-safety, invent-specs, secrets, DIY bypass
• Approve endpoint inert (charged: false) until owner LIVE
• Secrets via wrangler secret — never in client JS or repo

Reporting

Report suspected security issues to the product owner (Sm0k367 / Epic Tech AI). Do not include shop keys or customer PII in public channels.

DNS note

Prefer fielddesk.epictechai.app as the primary hostname. Some alternate hostnames may experience DNS resolution issues on certain resolvers.