Draft a browser-to-proxy policy and run a signed metadata check. A separate provider proxy is implemented but remains fail-closed until credentials, a quota store, independent security review, and spending controls are configured.
Checks HTTPS origin format, same-site path format, rate-limit bounds, schema-validation selection, and whether you reported a client-side secret risk.
QI session verification, exact-origin checks, fixed upstream host, text-only schema, sensitive-identifier checks, request bounds, atomic Upstash per-user/global daily quotas, and an independent-review/spend-control gate. These are code controls, not an independent assessment.
Dedicated secrets and quota store, provider-side spending controls, an independent security review, then a signed staging test. The route remains disabled until those gates pass.
No upstream request has been made from this page. The new route reports its gated state after QI sign-in.
Not collected or displayed by this page. Store any eventual secret in a reviewed server-side environment, never in browser storage.
Only a successful QI metadata check returns a request ID. Local draft saves are not a server audit record.
Origin, path, limits, and checkbox are stored in this browser only. Clearing site data removes the draft.
Sends only the policy metadata to QI’s product-pilot evaluator. The result requires human review and is not a security certification.