Strict request validation
Content type, body size, allowed fields, text length, control characters, and review horizons are validated server-side.
Security
Practical controls for public pilots and production-candidate deployments.
DefectGrid minimizes stored data, validates every brief request, and fails closed when required production protections are unavailable.
Current posture
Controls available today.
Distributed rate limiting
Production requests require a configured distributed limiter. The brief API fails closed when that protection is unavailable.
Schema-validated generation
Live AI output is constrained and validated against the product schema before it reaches the interface.
Minimal retention
DefectGrid does not maintain a server-side brief database. Device history is optional and can be cleared by the user.
Browser protections
Content security, frame blocking, MIME protection, referrer control, transport security, and restricted browser permissions are set globally.
Safe operations
Requests receive support IDs, private responses are not cached, and structured logs exclude manufacturing input text.
Enterprise roadmap
Controls required before shared factory workspaces.
- Authentication, organization isolation, and role-based access
- Encrypted persistence with configurable retention and deletion
- Workspace audit history and evidence-level access controls
- Independent penetration testing and incident-response exercises
- Formal vendor, privacy, and compliance assessments