Privacy

ReadinessAPI processes submitted OpenAPI contracts in memory to produce a score or audit. We do not intentionally persist raw contracts and do not include contract text or detected secret values in application logs.

Browser URL imports

URL imports happen in your browser. The browser fetches the public HTTPS file and then sends its text to the scoring endpoint. The HTTP API does not fetch specification URLs or resolve remote references.

Operational data

We record bounded operational events such as request ID, route, status, duration, input-size bucket, rules version, and error code. Client addresses are transformed with HMAC-SHA256 before rate-limit identifiers are stored.

Paid retries

Successful paid reports and hashed payment identifiers are retained in Redis for up to 24 hours to make retries safe and detect conflicting reuse. Reports can contain findings and schema fragments derived from the submitted contract.

Testnet beta

The paid endpoint uses Base Sepolia test USDC. Do not submit confidential contracts during the beta. Contact the operator with a request ID if you need help investigating an operational failure.