Talon Agent Autopsy · Security
Security
How Talon Agent Autopsy protects the data that passes through it.
Architecture
- Static frontend, zero runtime dependencies. The page is plain HTML/CSS/JS; there is no third-party script on the page.
- Server-side secrets only. Any API keys live in Cloudflare Worker secrets. They never ship to the browser and are never exposed client-side.
- Same-origin keyless API. The frontend calls the Worker same-origin; cross-origin API consumers require a shared secret. Rate limiting (10 requests/minute/IP) protects the API.
Data handling
Cached demo runs ship with the static site and contain synthetic, clearly labeled sample data. No build inputs or outputs are transmitted to our servers in LIVE mode (the build runs locally).
Transport and headers
All traffic is HTTPS with TLS 1.2+. Every response carries security headers: HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers.
Third parties
No third-party processors are involved in the static demo. In LIVE mode, the build is executed locally by your own tooling.
Disclosure
Security findings can be reported via /.well-known/security.txt on the service domain or by email to info@raptorlabs.dev.
Limitations (honest)
Talon Agent Autopsy is a demonstration-grade tool, not a compliance product. It does not hold SOC 2 or ISO 27001 certifications, and its rate limiting relies on Cloudflare KV, which is eventually consistent — treat it as a throttle, not a security boundary.