Architecture and integrations

The web application provides the public site, authenticated workspace and assessment routes. A gateway handles additional control-plane workflows where configured. Supabase provides authentication and database services.

Security tools run in a separate execution runtime. Status and evidence return for review; the browser does not run every assessment tool.

The application records the target and goal, plans tasks and dispatches work. The runtime reports progress and outcomes. Findings feed reporting and remediation workflows.

Review task state to understand coverage. Background processing may fail independently of the interface; a responsive dashboard does not establish completed execution.

Use authenticated user-facing routes for integrations. Internal callbacks and workflow-administration interfaces are operational contracts, not general public client APIs.

Protect tokens, redact logs and confirm supported deployment behaviour. Planning documents describe intended work as well as implementation; they are not release guarantees.