15 lines
630 B
JSON
15 lines
630 B
JSON
{
|
|
"feature_id": "F-096",
|
|
"agent": "security",
|
|
"verdict": "APPROVED",
|
|
"summary": "The AI key stays server-side and is omitted from settings responses; generation is admin-authenticated and only writes empty SEO fields.",
|
|
"evidence": [
|
|
"GET settings returns aiApiKey as empty and only exposes aiApiKeyConfigured",
|
|
"AI provider calls occur in the backend with the key in an Authorization header",
|
|
"Generation endpoint requires admin authentication",
|
|
"No client-side provider call or API key exposure",
|
|
"Generated output is length-bounded before persistence"
|
|
],
|
|
"timestamp": "2026-08-20T20:11:20Z"
|
|
}
|