Security & responsible AI

WE USE AI TO
DEFEND WHAT WE BUILD.

We're a small applied-AI team. We find, verify and patch weaknesses in our own products and the systems we run for clients, with AI doing the heavy reading and a person approving every change.

Not a service we sell. This is how we build.

See the patch logOur AI commitments
Blue security shield with a glowing keyhole

4codebases

patched for the React Server Components remote-code-execution advisory

26API routes

moved to fail-closed secrets in a single review

40+findings

re-checked against the code by separate AI reviewers before fixing

AES-256GCM

encryption on card, billing and signature data

How it works

Find. Verify. Fix.

AI reads more code and more advisories than a small team could. People decide what ships.
  1. 01Step

    Find

    AI reviewers read our code and new security advisories and flag what could go wrong.

  2. 02Step

    Verify

    A separate, read-only AI pass re-checks every finding against the actual code. Nothing is fixed on a guess.

  3. 03Step

    Fix

    Highest risk first. A person reviews and approves every change before it ships.

  4. 04Step

    Prove

    Tested locally against the real endpoints, then shipped. Each fix is written up with its evidence.

  5. 05Step

    Watch

    Password-protected health checks report each system as all clear, degraded or critical.

Built in

What's Inside.

Safeguards running in our products today, not a roadmap.

Encryption

Encrypted at rest

Card, billing and signature data is encrypted with AES-256-GCM before it is stored.

Identity

One-time sign-in links

Client portals use emailed links instead of passwords. Links expire and stop working after first use.

Secrets

Fail-closed secrets

If a key is missing, the system refuses the request. No default fallbacks, and signatures are compared in constant time.

Access

Locked-down APIs

Admin routes need a signed session or a server token. Public routes return only an allowlist of fields.

Safeguards

Off by default

Client notifications and automated messages ship switched off and need an explicit switch to run.

Audit trail

Signed and stamped

Agreements record a one-time code check plus an IP and device stamp, kept with the signed record.

Privacy

Private pages stay private

Session recording and analytics are switched off on admin and client portal pages.

Resilience

A second copy

If the main database is down, client proposals read from a backup store instead of failing.

Abuse

Bot checks on forms

Public forms run a Cloudflare Turnstile check before anything is accepted.

Patch log

What We've Done.

Real work from our repositories, oldest first. Product names are kept generic.
security-patch-log14 entries
  1. 2025-08-06HardenedE-commerce platformMoved exposed API credentials out of the codebase into server-side secrets.
  2. 2025-12-10Patched4 Next.js codebasesPatched the React Server Components (React Flight) remote-code-execution advisory.
  3. 2026-01-30PatchedService-business siteFixed React Server Components CVEs and upgraded Next.js to 15.1.9.
  4. 2026-03-13PatchedPhone systemRemoved an authentication bypass.
  5. 2026-04-11HardenedClient proposalsAdded a backup store so client documents stay readable if the main database goes down.
  6. 2026-04-22BuiltClient onboardingSigning with email or SMS one-time codes and an IP and device audit stamp.
  7. 2026-05-19BuiltBillingEncrypted billing profiles in the admin.
  8. 2026-09-09HardenedEmail campaignsHardened sending and added a working unsubscribe.
  9. 2026-10-04BuiltProject boards appTwo-factor authentication, email reset and tiered share links.
  10. 2026-10-09PatchedClient portal + dental platformSecurity review fixes: one-time login links, no fallback secrets across 26 routes, constant-time checks, locked-down APIs.
  11. 2026-10-12BuiltAgreementsEncrypted digital signing.
  12. 2026-10-14HardenedData APIEvery server request to the data API now carries a server-only key.
  13. 2026-10-22PatchedDirectory platformUpgraded to Next.js 16.4.2 for critical security advisories.
  14. 2026-11-05BuiltClient portalsSecure access exchange for portal links sent with invoices.

Straight talk

Realistic Expectations.

Security is ongoing work, not a badge. Here is what that means for us.

What we do

  • Patch known advisories in Node.js, Next.js, React and our dependencies once fixes are published.
  • Encrypt sensitive data and keep keys on the server.
  • Review our own code with AI, then verify each finding before fixing it.
  • Fix the highest-risk items first and write down what changed.

What we won't claim

  • Call any system unhackable. Software has bugs; our job is to find and fix ours sooner.
  • Claim certifications we haven't earned.
  • Sell security testing, or test systems we don't own or aren't authorized to work on.
  • Let AI ship changes on its own. A person approves every fix.

Responsible AI

AI For Defense.

How we hold ourselves to using capable models for good.

  1. 01Defensive only

    We use AI models to find and fix weaknesses in software we own or are authorized to maintain. Nothing else.

  2. 02Read-only reviewers

    Review agents read and report. They don't change code or touch production.

  3. 03Human approval

    A person approves every code change, and outbound proposal emails wait for owner approval.

  4. 04No offensive work

    No exploit development against others, no malware, no testing third-party systems without permission.

  5. 05Written record

    Each review and fix is logged with the evidence behind it.

Found something?

If you spot a security issue in something we built, tell us. We respond within 24-48 hours.

Report an issue

marketing@rperformancemarketing.com