Finite boundaries, visible failures.
VariantGate minimizes server-side exposure and treats identity, billing, quotas, and provider delivery as explicit state machines.
Browser isolation
File inspection runs in a Web Worker with file-count, compressed-size, uncompressed-size, entry-size, and traversal limits. No upload endpoint accepts creative assets.
Account protection
WorkOS AuthKit owns credentials and sessions. Registration requires a short-lived hCaptcha-backed intent, and the signed WorkOS registration action fails closed on invalid, expired, or replayed requests.
Workspace authorization
Every protected Convex function derives the caller from the verified WorkOS token and checks workspace membership. Browser-supplied user and workspace identifiers never establish authorization by themselves.
Provider reliability
Signed webhook events are durably recorded by provider event ID before asynchronous processing. Duplicate, delayed, and out-of-order events are idempotent; retry exhaustion becomes a visible operations exception.