Input limits
Supported file types are limited to common room-image formats; uploads are capped at 5 MB and extreme pixel dimensions are rejected before RGB decoding.
Product security
A narrow prototype with a narrow data boundary.
The current controls prioritize input limits, explicit product boundaries, and minimal handling of uploaded room images.
Current product controls
No retained raw image
The framework may temporarily buffer or spool upload data while processing a request; the application does not retain the raw image in project storage afterward.
Protected integration
The JSON creation endpoint requires a server-configured private-beta key and fails closed when no key exists.
Current scope
The public demo enforces in-process request limits and bounded input handling. This remains a private-beta prototype, not a production multi-tenant service. Durable sessions, user accounts, encrypted object storage, audit logging, production edge controls, monitoring, backups, and incident operations remain gates for a generally available service.
Participant guidance
Use room-only images. Do not include people, mail, identity documents, payment information, screens, keys, access codes, or other sensitive details.
Report an issue
Send a concise description to [email protected]. Do not include exploit code, secrets, or personal data in the first message.