Technical evaluator previewPreview data
API surface, security controls, integration dependencies, and the evaluation checklist — drawn from the same code-backed catalogs the live panels use. Private traces and saved notes are not fabricated; they appear below only when the evaluator has real workspace data.
API endpoints
77
documented + auditable
Security controls
6/ 9 enforced
2 documented · 1 scope note
Integrations
6
2 hard deps, 4 soft
Eval criteria
8
weighted, category-grouped
API surface — sample of 6 routespreview
Service health, version, revision, environment, payment readiness, and support-contact configuration.
Signed-in account billing portal entrypoint and readiness check.
Signed-in account subscription state for account settings and billing views.
Owner-only funnel diagnostics guarded by signed-in admin email allowlist.
Owner-only revenue and webhook health rollups for operations review.
Owner-only operational status surface for internal checks.
71 more routes in the API Surface panel. The full catalog is derived from shipped BrainStack Studio route files.
Security posturefactual
- enforced
Supabase RLS for tenant data
All write paths go through createSupabaseServerClient with the authed user JWT; service_role is server-only and never bundled.
- enforced
Cookie-based session, httpOnly
Supabase sets httpOnly + SameSite cookies; useAuth/useSubscription read from session, not localStorage.
- enforced
Rate limiting on public endpoints
Durable token-bucket rate limiting wraps public tool surfaces and returns standard 429 headers.
- enforced
Stripe webhook signature verification
Webhook handler validates Stripe signatures before processing; readiness is included in live build health.
- enforced
Secret material never logged or echoed
Live health redacts sentinel config values; API keys are shown once at creation and not returned again.
- enforced
Persona-OS workspace surfaces unlisted from sitemap
Persona workspaces are unlisted from the sitemap and marked noindex — they're workspaces, not marketing pages.
3 more controls in the live Security Posture panel.
Integration dependenciesall 6
Supabase
hard depAuth (email+password / OAuth), Postgres, RLS, storage.
failure: Hard dep — outage = no auth, no DB reads/writes. Fail-closed at request boundary.
Stripe
soft depSubscription billing, checkout, webhook-driven entitlement sync.
failure: Soft dep — workspace remains readable; new subscriptions block until Stripe restored. Existing entitlements unaffected.
Resend / SES (provider-flagged)
soft depTransactional + notification email.
failure: Soft dep — UI flows succeed; email retry queue picks up later and readiness appears in build health.
Vercel platform
hard depEdge runtime, deploy infra, env var management.
failure: Hard dep — platform outage = full app down. Mitigated by Vercel SLA + DNS-level fallback.
OpenAI / Anthropic (provider-agnostic)
soft depLLM completions for content-factory + AI-assisted tool runs (where enabled).
failure: Soft dep — non-AI tools fully functional; AI tools fail-closed with provider error.
Cloudflare (CDN + DNS)
soft depAsset CDN + DNS + DDoS shield.
failure: Soft dep — origin serves on Cloudflare bypass. Static assets degrade gracefully.
Evaluation checklist — sample criteriapreview
Tenant isolation enforced server-side (RLS, not UI-only)
Foundational; UI-only isolation is a P0 finding in any audit.
Secret material never returned to client or logged
API key disclosure is a P0; one-time-show pattern is the bar.
Deterministic health endpoint with version + revision
Required for safe rollouts and incident triage.
Public endpoints rate-limited with standard 429 headers
Protects vendor from abuse + protects your bill.
4 more criteria in the live Evaluation Checklist panel. Use the live panel below to record verdicts and review the authoritative workspace status.
Security posture entries are factual and verifiable in the codebase — not marketing claims. Live panels below render build identity, saved notes, and your own traces when real data exists.
Checking workspace ownership
BSS is resolving the current account and browser recovery copy before editing opens.