Client records never reach this domain
This site is static. It contains no client data, no engagement folders, and no API that could return either. Everything published here is a description of the system — the system itself runs on the operator's machine.
Where each thing lives
| Artifact | Location | Reachable from the internet |
|---|---|---|
| Source documents (W-2, 1099, transcripts) | Operator's disk, gitignored | No |
| Generated reports and annotations | Operator's disk, gitignored | No |
Engagement API (/api/*) | Loopback only | No |
| Pipeline skills and dashboard source | Private GitHub repo | No |
| These marketing pages | Cloudflare Pages | Yes |
Why the dashboard is not hosted here
The dashboard's whole value is reading real engagement folders. Hosting it publicly would mean either uploading client tax records to a third party or exposing a filesystem API to the internet. Neither is acceptable for a service that handles Social Security numbers, wage histories, and IRS balances, so the deployed /app route is an empty shell: it looks for an engine on localhost and tells you how to start one if it cannot find it.
If you do need remote access
Run the local server as usual and put an authenticating proxy in front of it — a Cloudflare Tunnel with Access policies is the intended path. The origin stays on the operator's machine; the tunnel carries no credentials of its own; every request is authenticated before it reaches the API. Do not set ALLOW_REMOTE=1 and bind a LAN address instead: the server has no authentication of its own, which is exactly why it refuses that configuration by default.
Handling rules inside the pipeline
- Client folders (
clients/and legacy roots) are gitignored — documents cannot be committed by accident. - Uploads are reduced to a bare filename against an allowlist; a path in a filename cannot escape the engagement folder.
- The report endpoint serves only files the scanner already discovered for that client — the path never comes from the request.
- Reports render as React nodes rather than injected HTML, so a document can never execute markup in the operator's browser.
- Deliverables carry client names and income detail. Treat every engagement folder as regulated data at rest.
Known gap
Engagement reports committed before 2026-07-30 remain in this repository's git history. The repository is private and that exposure was accepted deliberately; if it is ever made public or shared more widely, that history needs rewriting first.