The public site is static and requires no secret, credential, database, CRM, webhook, provider object, account, or client workspace.
Default deny
Forms, uploads, cookies, analytics, storage, data enrichment, CRM access, outreach, solicitation, billing, and automated decisions are disabled or absent. The local checklist changes only visible page text and resets on reload.
Release controls
Changed bytes invalidate prior approval. A release requires exact checks, retained-route preservation, rollback evidence, and independent production observation.