Security

Surface 1 — Free-text booking ("type what you want")

• The model returns structured JSON only — date, time, venue hint, section hint. No raw output reaches the database or UI.
• Every field is then re-validated by ordinary code: dates must be parseable, times must be HH:MM, venue names are matched against the active-venue list, slot must be free in the booking table.
• You see a preview before any booking is created. You explicitly tap "Confirm" — the model never books on its own.
• Rate-limited to 10 calls per client per hour. Burning our LLM endpoint is a real DoS vector, so it costs you slots quickly.
• All calls go to our local model on a private network. No public LLM provider sees what you type.

Surface 2 — Payment receipt OCR

• The model returns structured fields only (bank, amount, transaction ID, time). Free-text in the receipt cannot become an instruction to the platform.
• Receipt acceptance is fail-open — we mark you as paid even if OCR fails, because we don't want OCR to gatekeep your match. Venues still verify the actual transfer landed.
• The image is stored read-only. We never re-process it under different prompts. We never send it to a public API.

Surface 3 — Match chat

• Chat messages are user-to-user. No model reads or responds in chat.
• HTML-escaped before render — no scripts, no iframes, no bypasses.

Surface 4 — Inbound email (planned)

When we add an inbox: From: headers never establish identity (business-email-compromise threat). Attachments quarantine without network. Summaries that touch any model carry zero authority — they cannot trigger payments, role grants, or external API calls. Hardening reviewed with our security peer agent.