Talon Prompt Autopsy · Security
Security
How Talon Prompt Autopsy protects the data that passes through it.
Architecture
- Static frontend, zero runtime dependencies. The page is plain HTML/CSS/JS; there is no third-party script on the page.
- Server-side secrets only. Any API keys live in server-side secrets. They never ship to the browser and are never exposed client-side.
- Same-origin keyless API. The frontend calls the API same-origin; cross-origin API consumers require a shared secret. Rate limiting (10 requests/minute/IP) protects the API.
Data handling
No prompt text is stored anywhere. Only per-IP rate-limit counters (10 requests/minute) are kept in Cloudflare KV for 120 seconds. Report results exist only in your browser session.
Transport and headers
All traffic is HTTPS with TLS 1.2+. Every response carries security headers: HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers.
Third parties
When real mode is enabled, the prompt is sent to DeepSeek (deepseek-chat, JSON mode) for a single analysis call. The API key is held server-side as a Cloudflare Worker secret and never shipped to the browser. In mock mode (default for local development), no external call is made at all.
Disclosure
Security findings can be reported via /.well-known/security.txt on the service domain or by email to info@raptorlabs.dev.
Limitations (honest)
Talon Prompt Autopsy is a demonstration-grade tool, not a compliance product. It does not hold third-party compliance certifications, and its rate limiting relies on an eventually consistent platform store — treat it as a throttle, not a security boundary.