Unattended Works

Launching soon

Unattended Works · Public audit intake

Public audit intake

From URL to proof to test checkout to a downloadable evidence package, without creating an account or handing us an email address.

Account
Not required
Ownership
Short-lived DNS TXT proof
Checkout
Stripe test mode only; no live charge
Status access
Signed, short-lived, server-checked token
Recovery
Receipt restores access without a rerun

Public test checkout

Prove a site, run its audit, keep the recovery code

This page sends only the actions you request to https://api.unattendedworks.com, our first-party audit API. There is no account, analytics, advertising, fingerprinting, or other tracking. The checkout is Stripe test mode: no live charge can be made.

  1. Enter the HTTPS URL.
  2. Publish the DNS proof.
  3. Use test checkout.
  4. Download the package.

The deployment must already admit this host. You will prove control before checkout.

Idle. Nothing has been sent.

Recover an existing order

What this page does

The public path accepts only an HTTPS host the deployment already admits. It issues a short-lived ownership challenge and queues nothing until that proof is verified. Test checkout uses Stripe’s test environment and manual capture. A charge can be captured only after the runner has built and verified the report package.

The status credential is signed, contains at least 256 bits of fresh randomness, expires within an hour, and is checked against server-side state on every use. The recovery receipt can mint a new status credential without creating another order or rerunning the audit. Keep it private; the service stores only its SHA-256 digest.

Download links are valid for 7 days. Audit artifacts are retained for 30 days, then deleted under the same retention policy as the operator path.

Privacy and network disclosure

There are no accounts, analytics, advertising pixels, fingerprinting scripts, social widgets, or undisclosed network requests. This page contacts only the first-party API named above in response to an action you take. Credentials are kept only in the current page’s memory. They are not put in cookies or browser storage.

Limits

Ownership proof does not widen the runner into an arbitrary-origin proxy. The host must be in the deployment’s fixed admission policy, DNS and network policy are checked again at execution, authenticated and private pages are out of scope, and the bounded queue may refuse new work when full.