Security
Trust and access
Who can see agency data, who can spend credits or write to cfo.ai, and what is public.
Access
Everything under /app, /import and the API needs the team password. The landing page, the sample walkthrough and these docs are public and read no agency data. Five wrong passwords lock sign-in from that address for 15 minutes.
Who writes where
Only the worker calls Crustdata and cfo.ai. Each review has a credit and model-call budget; the run stops when it's used up. cfo.ai writes go only to the Reviewed and Downside scenarios set up for the agency, never Main.
Keys
Keys live in the server's environment file and the cfo.ai token file, outside the repository. See SECURITY.md to report a problem.