Email support@corpuslaw.us with "SECURITY" in the subject. Please do not open a public issue for a vulnerability.
Include what you found, how to reproduce it, and what you think the impact is. We will acknowledge within 3 business days.
This repository contains thin clients of the hosted Corpus platform. It holds no law data, no payment code, and no filing execution. That matters for triage:
| Concern | Where it lives |
|---|---|
| Client code in this repo | In scope — report here |
The hosted API (corpuslaw.us/api/*) |
In scope — report here, same address |
| Payment handling, filing execution, the approval gate | Hosted platform, closed source — report here, same address |
The Formation Autopilot produces a prefilled draft link. It never initiates a filing and never charges a card. On the platform side every order passes a human approval gate bound to a hash of the exact filing payload — if the payload changes by a byte after approval, the gate rejects it. An agent is architecturally incapable of bypassing this.
QWEN_API_KEYandCORPUS_API_KEYare read from the environment. Never commit them;.envis gitignored and.env.examplecarries empty values.- Note that
s deployechoes environment variables to stdout. Treat deploy logs and terminal scrollback as secret-bearing, and rotate a key that has appeared in a shared log. - Founder PII in a handoff link rides the URL fragment (
#prefill=), which browsers never send over HTTP, so it stays out of server and CDN access logs. If you fork this and move that payload into a query string, you reintroduce that leak.
No tool in this repo accepts one, and there is no field for one in the handoff payload. EIN responsible-party SSNs are entered by the founder directly into a secure panel on the hosted platform. If you extend this kit, keep it that way.