Scope and security posture
This page describes controls implemented for the public durbash.com marketing website and its live AI voice and chat previews. It is not a security specification for a future customer workspace and does not replace customer-specific diligence or a written security agreement.
Operator and contact
The operator and published legal identity for this public website is Durbash.com.
Durbash.comBuilding No. 23, Subhash Nagar, Saharanpur, Uttar Pradesh 247001, IndiaPhone: +91 85298 97855Email: [email protected]Use email for vulnerability reports so technical details and follow-up remain in writing.
Implemented public-site controls
| Area | Implemented control | Boundary |
|---|---|---|
| Credentials | OpenAI credentials remain in server-side environment configuration and are never intentionally exposed through a public browser variable. | This applies to the two public AI API routes. |
| Browser requests | AI endpoints check browser origin signals, require exact content types, and reject malformed or oversized bodies. | Non-browser abuse is also managed with request limits; origin checks are not authentication. |
| Rate limits | Chat uses bounded in-memory controls plus origin-proxy client and global limits. Voice uses bounded in-memory and origin-proxy per-client limits. | Public preview protection, not a customer account quota. |
| Data minimization | Inputs, conversation length, provider responses, and execution time are bounded. API responses use no-store and no-sniff headers. | Providers and infrastructure may still maintain operational or abuse-monitoring logs. |
| Safety identifiers | Connection information is transformed with HMAC into opaque identifiers used for rate limiting and OpenAI safety controls. | Cloudflare still processes network connection data while serving the site. |
| Write actions | The public AI tools can navigate a product-guide workflow or end a session; booking, messaging, CRM writes, and human transfer are disabled. | Customer integrations require separate validation and authorization. |
Transport and browser protections
The production site is available over HTTPS. Live voice uses browser microphone permission and WebRTC transport to OpenAI after the Durbash server brokers session setup. Ending the session closes the peer connection, data channel, and microphone tracks in the browser.
Website responses define a content security policy, anti-framing rules, MIME-sniffing protection, a strict referrer policy, HSTS for HTTPS visits, and a Permissions Policy that allows microphone use only by the same site while disabling unrelated camera, location, payment, and USB access.
These controls reduce common browser risks; they do not make the public preview suitable for secrets or regulated data.
AI data boundaries
OpenAI receives the text or live audio required to provide the public AI experience, together with a pseudonymous safety identifier. The chat request disables Responses application-state storage with store: false. That setting does not mean zero provider retention.
The current Durbash public-site code does not include a persistent conversation database, account system, analytics SDK, advertising tracker, or write-action integration. Browser transcripts remain local to the page state until reset, a new session, or reload.
See the Privacy Policy for the complete data-flow and provider-retention explanation.
Providers and connection status
| Service or category | Public status | Purpose |
|---|---|---|
| OpenAI API | Active in the public demo | Live voice, transcription, and streaming product chat. |
| Cloudflare | Active edge infrastructure | Public TLS proxying, delivery, protection, and edge observability; application compute runs on Durbash infrastructure. |
| Scheduling, CRM, messaging, and lead systems | Customer-scoped | Not active write integrations in the public demo; exact vendors and permissions must be validated before setup. |
Responsible disclosure
To report a suspected vulnerability, email [email protected] with “Durbash security report” in the subject. Include the affected URL, a concise description, reproducible steps, impact, and non-sensitive supporting evidence.
- Do not access, change, retain, or disclose another person's data.
- Do not disrupt availability, send high-volume traffic, use social engineering, or test third-party providers.
- Use the minimum interaction necessary to demonstrate the issue and allow reasonable time for review before disclosure.
- This contact process is not a bug-bounty program and does not authorize activity that would otherwise be unlawful.
A machine-readable contact is published at /.well-known/security.txt.
Customer security review
Before a production rollout, Durbash and the customer should document the systems involved, data categories, access model, retention needs, regional requirements, incident contacts, vendor terms, and any required contractual or compliance controls.
Public product mockups and connection categories are not evidence that those production controls or integrations are already available. Use the Book a Demo page to discuss your intended workflow without sending confidential implementation details through the AI preview.
Updates
Durbash may update this page as controls, providers, and public features change. The date at the top identifies the version reviewed against the current public-site implementation.