Security

Last updated: 2026-09-23 · Effective: 2026-09-23 · Product: Maintenance Tech Desk

Controls (current deploy)

• TLS via Cloudflare; HSTS enabled on Worker responses
• Security headers: CSP, nosniff, frame deny, Referrer-Policy, Permissions-Policy, COOP
• CORS allowlist for production hosts — no wildcard
• Shop key via X-MTD-Key only (query-string keys rejected)
• Timing-safe shop key compare; rate limits on /api/ask and auth failures
• JSON body size limit (~32KB); ask length capped
• Refuse rules for automatic purchasing, license stamps, life-safety, invent-specs, secrets, DIY bypass
• Approve is draft acknowledgment only (charged: false, never_charges: true) — this desk does not process payments
• Secrets via wrangler secret — never in client JS or repo

Reporting

Report suspected security issues to Epic Tech AI support. Do not include shop keys or customer PII in public channels.

DNS note

Prefer fielddesk.epictechai.app as the primary hostname. Some alternate hostnames may experience DNS resolution issues on certain resolvers.