# Qurmmius Code Preflight — external review intake

Status: local-only code/configuration preview and internal checks only. No independent legal, privacy, accessibility, or application-security review has been completed. Do not describe this utility as a security certification, compliance product, legal review, or production approval. “QCS” may remain an internal project label; the public working name is Qurmmius Code Preflight.

## Product scope to review

Qurmmius Code Preflight is a browser-based text-pattern utility at `/compliance-shield/`. It accepts pasted text or local UTF-8 source/config/Markdown/JSON files up to 200 KB. It checks selected code/configuration patterns and basic JSON syntax only. It does not accept or analyze contracts, records, privacy policies, or legal documents. Redaction and AI explanation have been removed from this pilot; the shared provider edge route rejects QCS modes and reports `disabled-local-only`. The findings-only Markdown export does not include original input. The page does not persist source text to an application backend; browser extensions, device backups, and browser-restoration behavior are outside the page's control.

This preview does not parse PDF/DOCX, execute source, validate a schema against a live system, or establish that code is safe. Pattern checks are narrow and can miss issues or produce false positives. They must not be represented as a security score or approval. Use sanitized/synthetic text, not live credentials or customer data. Verify no pasted/file text is sent through page scripts, logs, telemetry, or any other network path in the deployed build.

## Independent application-security review requested

Review the browser code and the product route, including:

- Local file handling, size/type checks, output rendering, content persistence, and report export; test XSS and malicious pasted/file contents.
- Confirm the browser scan has no outbound code/text path, including via page scripts, logs, telemetry, analytics, or a direct provider endpoint call.
- Test local file type/size boundaries, malicious pasted/file content, output rendering, report export, and input reset/clear behavior.
- Review the shared ContextKey edge endpoint separately; confirm `qcs-code` and `qcs-document` modes are rejected before provider use and QCS status remains `disabled-local-only` even if ContextKey credentials are configured.
- Confirm that any static checks, UI text, and exported reports describe heuristic findings only and cannot be mistaken for a security score, certification, or compliance determination.

Use staging only, synthetic samples, short-lived least-privilege credentials, and an agreed secure transfer channel. Do not submit real customer contracts, health/financial records, live credentials, QI signing secrets, or encryption keys. Deliver a written report with scope, limitations, severity, reproduction steps, remediation, and retest outcome.

## Qualified legal and privacy review requested

Ask a Pennsylvania technology/privacy attorney to review the public name, marketing claims, user-facing scope, terms/privacy notice, and whether the revised tool boundaries are clear. Contract/legal document analysis is out of scope and removed from this pilot. The disclaimer is not a substitute for product-boundary analysis or counsel.

The current QCS patterns flag topics for a human to inspect; they do not determine legal effect. No attorney's review or approval is implied by the interface.

## Accessibility review requested

Conduct keyboard-only, screen-reader, zoom/reflow, focus-order, color/contrast, status announcement, form-label, and mobile tests against the deployed preview. The repository's automated HTML baseline is only a static smoke check and is not an independent WCAG conformance audit.

## Gate record — intentionally blank

- Security reviewer / organization and qualifications: ____________________
- Security scope, staging URL, and report reference: ____________________
- Findings, remediation, and retest date: ____________________
- Qualified counsel / organization and written scope: ____________________
- Privacy/data-flow review date and decisions: ____________________
- Independent accessibility reviewer and report reference: ____________________
- Provider retention, account spend control, and approved model: ____________________
- Operator approving the exact test scope and date: ____________________

Do not enable a QCS AI/provider mode. The QCS local-only boundary is enforced in the shared edge route independently of ContextKey provider configuration. Do not invent approvals or mark the product production-ready.