The portal minimizes public WordPress identity exposure and keeps model data out of server-side forms and tools. This page states controls and boundaries; it is not a security certification.
Website controls
- Public user enumeration and author archives are disabled or redirected.
- Comments and XML-RPC are disabled because the portal does not require them.
- Public REST output is limited to approved published content and path-free metadata.
- The contact form uses a nonce, honeypot, rate limiting, sanitization, no uploads, and no model-path or credential fields.
- Browser-local tools do not submit entered paths, hashes, prompts, environment details, or generated configuration.
- Response headers include nosniff, strict-origin referrer policy, a restrictive permissions policy, frame denial, and a reviewed same-origin CSP.
- HSTS remains owned by the HTTPS reverse proxy after transport verification.
Runtime threat boundary
- The host must establish model source, license, identity, trusted roots, size ceilings, reparse-point policy, and application approval.
- Do not add remote model upload, arbitrary filesystem path, arbitrary URL fetch, provider-key, command-execution, or private-network probe endpoints.
- Bind local service examples to loopback and apply separate threat modeling before any broader exposure.
- Treat GGUF parsing as untrusted binary intake with explicit bounds.
Report a security concern
Use the contact form and choose Security report. Do not include credentials, private prompts, model bytes, or sensitive local paths. The canonical machine-readable policy is available at /.well-known/security.txt.
Operational boundary
What this page covers: Website and host-application security controls, privacy choices, and report handling.
Available now: Specific hardening controls and a public reporting route are implemented.
Host responsibility: Maintain server, TLS, updates, backups, access controls, mail delivery, runtime threat models, model trust, and application security.
Not claimed: Absolute security, security certification, model safety, or protection from every malicious artifact.
Canonical sources: WordPress security review · LocalEndpoint boundary
Last reviewed UTC: