# Brandloop Security And Crawl Boundary Summary

Last updated: 2026-07-09
Canonical site: https://brandloop.app/

## Scope

This is a public security summary for buyers, crawlers, and agents. It is not a full security whitepaper, compliance attestation, penetration-test report, or vulnerability disclosure policy.

## Access Control

- User workspaces and product routes require authenticated access.
- Public API operations require Brandloop API keys presented as bearer credentials.
- API keys are scoped by product capability and should only be used against Brandloop public API contracts.
- Public discovery files such as /llms.txt, /product.md, /security.md, /comparison-data.json, /openapi.json, and /developers/api do not grant product access.

## Data Boundary

- Brand sources, generated assets, generation records, workspace settings, billing actions, and channel connections are treated as workspace-owned product data.
- Provider credentials, webhook secrets, service-role credentials, billing mutations, and private storage details are not exposed through public agent files.
- Agents should use published Brandloop API contracts and scoped API keys. They should not attempt to call underlying providers directly with Brandloop secrets.

## Crawler And Indexing Boundary

- /robots.txt is crawler guidance for public indexing. It is not an authentication, authorization, or data-loss-prevention control.
- Authenticated app routes, auth callbacks, private API routes, provider webhooks, and billing mutation routes are excluded from sitemap entries.
- Public documentation routes remain crawlable so search engines, answer engines, and browser agents can understand the product without signing in.

## Public Developer Surface

- API reference: https://brandloop.app/developers/api
- OpenAPI JSON: https://brandloop.app/openapi.json
- API docs redirect: https://brandloop.app/api-docs

## Operational Notes For Agents

- Prefer visible public pages and machine-readable documents listed in /llms.txt.
- Do not treat missing sitemap entries as proof that a private URL is secure.
- Do not submit credentials, secrets, payment data, or customer content into public crawlable files.