Report an issue
Email sohagan@aiembeddedsystems.com with the affected URL, a short impact statement, and repeatable steps. Remove session cookies, Google tokens, Station credentials, pairing codes, prompts, private output, and personal information from the report.
The machine-readable contact is /.well-known/security.txt.
Good-faith testing
Stay within DemoAPI.org and records created by your own account. Do not test denial of service, social engineering, physical security, Google, Cloudflare, OpenAI Sites, a submitted third-party URL, or another owner’s hardware. Do not keep data you reach by mistake.
Google identity and browser sessions
Google sign-in requests OpenID, email, and basic profile access. Better Auth keeps the browser session server-side for up to 24 hours. State-changing browser routes require the authenticated owner, an exact configured origin, JSON, and a CSRF token. Owner queries include the internal user ID, and private GET responses are not cached.
The Station credential is separate from the Google session. The browser cannot use its account cookie to claim a Run or manufacture an Armed Recipe. The connector cannot use its Station credential on browser account routes.
Outbound Station and sealed Recipe boundary
The connector opens outbound HTTPS to DemoAPI and loopback access to a fixed local adapter. It does not open an inbound port or accept a cloud-supplied URL, host, method, header set, path, workflow, executable, or shell command.
Each Recipe binds one local action and publishes an HMAC fingerprint. A Run carries only the exact typed fields allowed by that Recipe. Station credentials and pairing codes are stored as keyed verifiers. Revocation changes the Station state and invalidates its verifier before account cleanup begins.
Receipts, artifacts, and deletion
Events and Receipts use bounded fields. Receipts omit prompts, local paths, raw logs, machine addresses, and secrets. Artifact uploads use one server-derived R2 key and a fixed media, size, and SHA-256 policy. R2 is private; owner downloads are authenticated attachments with content sniffing disabled.
Artifact access ends after 24 hours. An hourly job deletes expired R2 objects before deleting their D1 rows. Account deletion follows the same order: revoke the Station, remove every owner-prefixed R2 object, then delete the account data and sessions. Interrupted cleanup remains locked and can be retried.
Cancellation and remaining risk
Cancellation is best effort once local software has accepted a Run. Revoking a Station blocks later connector requests, but it cannot erase an output already written on the computer or promise that a local process stopped immediately.
A person or program that controls the owner’s Windows account can read local files, alter installed software, or steal a live Station credential. Keep the computer patched, restrict physical and remote access, and separate the managed Comfy profile from personal extensions. DemoAPI narrows remote authority; it is not a sandbox for a compromised PC.