Skip to content
Trust Center

Browser-local by default. Every audited boundary is disclosed.

Review the ordered manifest records covering same-origin loads, explicit and configured operations, browser navigation, negative controls and unresolved host boundaries.

Manifest-backed disclosure · 11 records · 0 unresolved
Legend
What the capability badges mean

Every screen carries a capability badge with the strongest truthful limitation of its engine. The workbench never claims more than it can prove:

  • Local — runs entirely in this browser; no connection needed.
  • Live — a runtime connection exists AND an explicit check has proven it in this session.
  • Needs CI / Agent / Hosted / Browser open — the screen’s engine needs that runtime counterpart, and no live check has proven the connection yet. This is the fail-closed default, not an error: the screen itself works and explains what to connect, and the badge resolves the moment its runtime proves a connection. The badge names what is missing rather than reporting the state as unknown, because “unknown” reads as breakage when the truth is a prerequisite. Hover any badge for the exact limitation.
  • Unknown — reserved for a capability identifier that is not in the audited manifest at all. Unlike the line above, that is a defect in this application rather than something you can connect.
  • Beta / Preview / Roadmap — the declared maturity of the capability, straight from the audited manifest.
Verify it yourself
Runtime check against the manifest

Use the browser network panel as runtime evidence, then reconcile what you observe with the full manifest below. It includes same-origin loads, configured browser behavior, external navigation and a host-conditional callback as well as explicit operations.

  1. 01Open DevTools → Network. Tick “Preserve log”.F12 / Cmd-Opt-I
  2. 02Exercise only the routes and actions that are in your review scope.bounded run
  3. 03Compare observed requests with every manifest record below.manifest
  4. 04Keep configured destinations and the APIMaster local error negative control in review.do not infer
Audited manifest
Outbound paths, browser boundaries and negative controls
01Same Origin Bundled SpecsVerified
same-origin-bundled-specs · Same-origin asset · Same-origin application asset
Trigger
API Explorer or TMF pack load/install
Destination
Same origin under /specs/tmf/
Destination control
application-same-origin
Action model
No contemporaneous user action required
Transport
Application transport
Workspace boundary
This record does not send workspace data

Data: bundled manifest · bundled specification

Prerequisites: The bundled asset must exist on the current application origin.

Limitations: Missing offline assets degrade to an empty manifest or install failure.

Evidence: source: src/routes/api-explorer.tsx · source: src/lib/tmf-pack.ts

02Explorer Live HttpVerified
explorer-live-http · Explicit user action · Previously documented core flow
Trigger
The user presses Test key or Send while the Explorer is in live mode.
Destination
The selected environment URL, optionally through the configured CORS relay.
Destination control
user
Action model
Explicit user action
Transport
Application transport
Workspace boundary
Workspace data may leave the browser

Data: HTTP method · headers · query · optional request body

Prerequisites: A user-selected environment and an explicit send action.

Limitations: Live mode can fail because of offline state, transport, or CORS policy.

Evidence: source: src/routes/api-explorer.tsx · source: src/lib/swaggermaster/tryout-client.ts · source: src/lib/swaggermaster/tryout-policy.ts

03Url Spec Load And Watch CheckVerified
url-spec-load-and-watch-check · Explicit user action · Previously documented core flow
Trigger
The user imports a URL or presses Check now for a saved watch.
Destination
The user-provided URL, including normalized or probed paths on that origin.
Destination control
user
Action model
Explicit user action
Transport
Application transport
Workspace boundary
This record does not send workspace data

Data: GET request · Accept header · conditional request headers

Prerequisites: A user-provided URL and a contemporaneous import or check action.

Limitations: Generic watch may download the full specification when conditional requests are unavailable. Failure must not replace the persisted baseline.

Evidence: source: src/lib/spec-loader.ts · source: src/domain/store.ts

04Graphql ConsoleVerified
graphql-console · Explicit user action · Additional explicit operation
Trigger
The user presses Introspect or Run.
Destination
The user-entered GraphQL URL.
Destination control
user
Action model
Explicit user action
Transport
Application transport
Workspace boundary
Workspace data may leave the browser

Data: GraphQL query · variables · user-supplied authentication headers

Prerequisites: A user-entered GraphQL URL and an explicit action.

Limitations: The browser can report transport or CORS errors.

Evidence: source: src/routes/graphql.tsx

05Realtime ConsoleVerified
realtime-console · Explicit user action · Additional explicit operation
Trigger
The user presses Connect/Open stream; sending a frame requires another action.
Destination
The user-entered WebSocket or SSE URL.
Destination control
user
Action model
Explicit user action
Transport
Application transport
Workspace boundary
Workspace data may leave the browser

Data: connection handshake · WebSocket frames · inbound SSE events

Prerequisites: A user-entered URL and an explicit connect action.

Limitations: Browser handshake and cross-origin rules apply.

Evidence: source: src/routes/realtime.tsx

06Sandbox Explicit OperationsVerified
sandbox-explicit-operations · Explicit user action · Additional explicit operation
Trigger
The user starts a Companion connection, scan, live flow, replay, refresh, or poll.
Destination
The configured Companion Sandbox origin; the current default is localhost:8081.
Destination control
stored-user-configuration
Action model
Explicit user action
Transport
Application transport
Workspace boundary
Workspace data may leave the browser

Data: sandbox API key · scenario correlation id · OpenAPI reads · contract and radar reads · live step payloads

Prerequisites: A separately running Companion Sandbox and an explicit operation.

Limitations: The mock and offline paths remain separate from live Companion operations.

Evidence: source: src/lib/sandbox/client.ts · source: src/lib/sandbox/connect.ts

07Sandbox Route Auto ProbesVerified
sandbox-route-auto-probes · Negative control · Verified negative control
Trigger
Mounting /sandbox or hydrating a remembered sandbox origin.
Destination
None.
Destination control
none
Action model
No contemporaneous user action required
Transport
No application fetch
Workspace boundary
This record does not send workspace data

Prerequisites: None recorded.

Limitations: Health, registry, and contract probes still run after explicit Refresh/Load actions.

Evidence: source: src/components/scenario-lab/sandbox/use-sandbox-status.ts · source: src/components/scenario-lab/sandbox/contracts-panel.tsx

08Configured WebhookVerified
configured-webhook · Configured browser runtime · Previously documented core flow
Trigger
A due or manually triggered schedule matches saved notification preferences.
Destination
The webhook URL stored on the schedule.
Destination control
stored-user-configuration
Action model
No contemporaneous user action required
Transport
Application transport
Workspace boundary
Workspace data may leave the browser

Data: schedule summary · change summary

Prerequisites: A saved webhook URL and matching schedule notification configuration.

Limitations: Offline attempts are skipped. A browser schedule depends on the application environment remaining active.

Evidence: source: src/domain/store.ts

09App Shell Schedule TickVerified
app-shell-schedule-tick · Configured browser runtime · Configured browser runtime
Trigger
After private-route hydration, the enabled in-browser timer checks due schedules.
Destination
No destination by itself; a due schedule can dispatch its saved webhook.
Destination control
stored-user-configuration
Action model
No contemporaneous user action required
Transport
No application fetch
Workspace boundary
Workspace data may leave the browser

Data: configured schedule summary when notification conditions match

Prerequisites: A hydrated private app route and an enabled schedule.

Limitations: The timer does not start on /welcome or before hydration. Background throttling, sleep, and a closed browser prevent continuous execution.

Evidence: source: src/components/shell/app-shell.tsx · source: src/hooks/useScheduleTick.ts · source: src/domain/store.ts

10Apimaster Local Error BoundaryVerified
apimaster-local-error-boundary · Negative control · Verified negative control
Trigger
A root browser or server error boundary handles a failure.
Destination
None. APIMaster writes a data-minimized report to the local console only.
Destination control
none
Action model
No contemporaneous user action required
Transport
No application fetch
Workspace boundary
This record does not send workspace data

Data: error name/code · one-way fingerprint · route pathname · boundary id

Prerequisites: None recorded.

Limitations: Messages, stacks, full URLs, request bodies, headers, credentials and workspace values are excluded. No remote monitoring or delivery SLA is claimed.

Evidence: source: src/lib/error-reporting.ts · test: tests/production-readiness-error-boundary.test.ts

11External Navigation And MailtoVerified
external-navigation-and-mailto · Browser navigation · External browser navigation
Trigger
The user clicks a displayed external URL or mailto action.
Destination
The displayed URL or the user's configured mail client.
Destination control
browser-user
Action model
Explicit user action
Transport
No application fetch
Workspace boundary
This record does not send workspace data

Data: browser navigation · prefilled email subject

Prerequisites: An explicit click.

Limitations: This is browser navigation, not an application fetch.

Evidence: source: src/routes/welcome.tsx · source: src/components/marketing/marketing-data.ts

3 previously documented core flows are a subset of this ordered 11-record audit. The first-party local error boundary is a verified negative control; explicit and configured operations still prevent an absolute zero-egress claim.
Live — this browser, right now
Local data inventory
localStorage keyPurposeSize
Scanning local storage…
For your DPO
GDPR mapping — architectural answers
ArticlePrincipleArchitectural answer
Art. 5(1)(c)Data minimisationWorkspace persistence is browser-local by default. Only the data required by an explicit operation or configured destination should be sent; review the audited boundaries below.
Art. 25Protection by design and by defaultThe manifest distinguishes same-origin assets, explicit operations, configured browser behavior, APIMaster-owned negative controls and browser navigation instead of asserting absolute zero egress.
Art. 32Security of processingThe local security boundary is the browser profile and device controls. Exported bundles support AES-256-GCM encryption; localStorage itself is not application-level encrypted at rest.
Art. 17Right to erasureSettings → Privacy & data removes application-managed local keys and creates a deletion receipt. It cannot recall data already sent to user-configured destinations.

Compliance is a property of your process, not of any tool. This table documents the architectural facts the workbench contributes to that process.

No theatre
Security posture — including the honest parts
What the architecture gives you
Manifest-backed disclosure for every audited outbound record and negative control
Optional AES-256-GCM encrypted workspace bundles (PBKDF2-SHA-256, 150 000 iterations)
Deletion receipts with a SHA-256 hash of the erased application-managed payload
Append-only audit log, production locks and role-gated actions in the workbench
What it does not do — read this part too
localStorage is not application-level encrypted at rest — anyone with access to your browser profile can read it. Use OS user separation and disk encryption.
Explicit API, URL, GraphQL, realtime and Companion operations can contact destinations you select; configured webhooks can run while the browser app remains active.
The APIMaster-owned error boundary records only a local fingerprint, code/name, route pathname and boundary id. It has no remote sink and excludes messages, stacks, credentials, request bodies and workspace values.
There is no hosted team sync or SSO today. Browser scheduling is not a daemon and stops when the runtime sleeps or closes.
Evidence file
Data Protection Annex (PDF)

A browser-generated architecture statement for vendor-risk reviews: processing summary, data location, all audited outbound records and the GDPR mapping above — stamped with this browser's live storage figures. PDF generation runs in this browser.

Your controls
Erasure & portability
Roadmap — future tense, on purpose
What is not built yet
Planned; not available in the current product.

Encrypted workspace sync — the target design uses client-side encryption. It is not a current capability or a confidentiality guarantee.

Planned; not available in the current product.

SSO (OIDC) and self-hosted distribution — planned for the Enterprise tier; priced when they exist.

Until then, collaboration is snapshot export/import — deliberately boring, deliberately verifiable.