Security model

What L80 and launch80 do with your token, your machine's details and what you publish.

On your machine

No third-party Go code. The binary holds your token, so it depends only on the Go standard library, including the console.
Secrets stay out of view. Tokens are masked in every output. Endpoint keys travel by environment, never on a command line or in a results file.
Private details stay home. Endpoints, hostnames and local paths are removed before publishing, and L80 refuses to publish if any remain.
Pinned, checksummed code. Tools run at a fixed commit, and L80 update and the install script check each download's SHA-256 before replacing anything. Read the installer.
Nothing is answered for you. L80 never answers a tool's confirmation prompt; the console asks before renting, destroying or publishing.

Data, not markup. You publish JSON. The server renders it from its own templates and escapes every value, so no uploaded HTML or JavaScript is ever served. Pages load no scripts and no remote assets (script-src 'none').
Tokens are stored as hashes. Only the SHA-256 of a token is kept, and it is compared in constant time.
Checks before parsing. Authentication, rate limits and the size cap all run before a body is parsed; a payload is checked for depth, size and non-finite numbers before schema validation.
Exact bytes kept. The body of each publish is stored as received, so its sha256 can be compared with the publisher's ledger.

The server recomputes every check from the stored page; a client's own results are shown, never trusted.
Verifier status is set by Launch80, never by a key holder, and a key can never decide on its own request.
Other users see a key's label, never its key id or any token material.
Every request and decision is written to an audit log.

Found a security issue? Email team@launch80.com rather than posting it in Discord.