Server-side authorization
Plan limits, ownership and protected actions are enforced by the application backend rather than trusted to browser JavaScript.
SECURITY
Security is part of the application boundary—not a JavaScript promise.
GenerativeRanks is designed so that browser code can be inspected or modified without becoming the authority for plans, ownership, payments or private credentials.
Credential protection
Connected provider credentials and OAuth tokens are stored server-side and protected using authenticated encryption in the application.
Request protection
Authenticated mutations use WordPress session/nonce protections, same-origin checks, rate limits and additional controls for expensive operations.
Tenant isolation
Brand-scoped records are checked against the authenticated user before private data is returned or changed.
Abuse controls
Burst throttles, job locks and plan quotas help reduce automated API-cost exhaustion and duplicate processing.
Safer AI workflows
Crawled pages, imported reports and external text are treated as untrusted evidence rather than trusted system instructions.
Import/export hardening
Supported report imports are validated for expected formats and size. CSV exports are protected against spreadsheet-formula injection.
Private application surface
Public marketing content is separated from the private workspace at app.generativeranks.com.
What the browser is allowed to know
Like any web application, GenerativeRanks must send HTML, CSS and JavaScript to a user’s browser. Those files are not treated as secrets. Sensitive decisions and provider credentials remain on the server.
What we do not promise
No internet-connected application can honestly claim that compromise is impossible. Security also depends on infrastructure, software updates, administrator account protection, third-party providers and responsible configuration.
Report a security issue
If you believe you found a security problem, contact [email protected] with reproducible details. Please avoid accessing or modifying data that does not belong to you.