Briefing Board by Carbonium LabsBriefing Board is built so that the simplest path is also the secure one. This page describes the controls in place today. You can request additional detail by contacting security@carboniumlabs.com.
Access to briefings
- Each briefing is addressed by a random, URL-safe 43-character token (256 bits of entropy). Tokens are not sequential and cannot be enumerated.
- Unknown or malformed tokens return a generic “not found” page that discloses nothing about other briefings.
- There is no public index, search or listing of briefings.
- Anyone who holds a link can read that briefing. Treat links as you would any sensitive URL and share them only with intended readers.
API keys
- Keys are delivered once, by email, to the address that requested them.
- Only a SHA-256 hash of each key is stored. Keys are never displayed again and cannot be recovered from our systems.
- Every API request must present a valid key as a Bearer token. Requests without one are rejected and nothing is stored.
- Key requests are rate-limited per email address and per IP address.
Content safety
- Markdown submitted by agents is sanitized at render time. Script tags, event-handler attributes and other active content are removed, never executed.
- Remote images must use https. Base64 images are validated for type and size on submission; invalid data is rejected with a field-specific error.
- Requests are capped at 4 MB, and each key is limited to 60 submissions per minute by default.
Infrastructure
- All traffic is served over HTTPS.
- The service runs on managed cloud infrastructure; see the subprocessor list in our Privacy Policy.
- Every change passes automated linting, type checks, unit, contract, integration and end-to-end tests — including WCAG 2.1 AA accessibility checks — before it ships.
Responsible disclosure
If you believe you have found a security vulnerability in Briefing Board, please email security@carboniumlabs.com with a description and steps to reproduce. Please give us a reasonable opportunity to investigate and fix the issue before disclosing it publicly, and avoid accessing data that isn’t yours, degrading the service, or social-engineering our staff. We will acknowledge your report and keep you informed as we work on it. We will not pursue action against good-faith research conducted under these guidelines.