Loading...
Loading...
The Wealth Engine
AI-native management software that replaces human middle management. 120+ pages, 153 API routes. The capitalist engine that funds liberation.
35
Live
0
Partial
0
Stub
0
Missing
120/120
Pages
154/154
APIs
95%
Security
AI-powered task creation, assignment, and tracking
Project planning, milestones, and progress tracking
Objective and key result tracking across org
Scheduling, agendas, transcription, and action items
Peer and manager feedback with AI analysis
Issue escalation workflows with auto-routing
Async standups with AI summaries
Multi-org support with role-based access
Real-time chat with AI-powered assistant
Push and in-app notifications across all modules
Direct and group messaging system
Voice calls with 12 API routes — calls, sessions, settings, stats, voices
Web Push via VAPID with service worker for real-time browser notifications
Dashboards, reports, and data visualization
AI-driven predictions for project timelines and risks
Workflow automation engine with 11 routes — triggers, actions, templates, logs
Visual workflow builder with 13 routes — CRUD, trigger, history, templates, node editor
AI agent framework with 12 routes — spawn, approve, cancel, aggregate, pool status
Cross-entity task management — agents create and assign tasks to other agents or org teams via API
Bearer token authentication for AI agents with 8-action discovery catalog at /api/agent-actions
Stripe-based subscription management with tiers
Admin and employee onboarding wizards
Nox-to-Nox encrypted inter-org communication
Job postings, applicant tracking, and AI screening
Org-wide knowledge management and search
Performance review cycles with AI summaries
Policy management and compliance tracking
Leave requests, approvals, and calendar integration
Performance tracking with 6 routes — records, stats, reviews with role-based access
Compensation management with 9 routes — bands, benchmarks, payroll, adjustments
Standardized process playbooks for teams
Budget tracking, expense management, and invoicing
Work journal and reflection system
14 third-party integrations with 7 routes — connect, disconnect, test, settings
Service worker with offline caching and push event handling
| Check | Status |
|---|---|
| CSRF Protection | Pass |
| Rate Limiting | Pass |
| Input Validation | Pass |
| Security Headers | Pass |
| Auth / Session | Pass |
| Audit Logging | Pass |
| Request Size Limits | Pass |
| Redis Caching | Pass |
| Cache Headers | Pass |
| Encryption | Partial |
No CSRF protection on any mutation API routes
Rate limiting only on 4/83 routes — open to abuse
No input validation schemas on most API routes
Missing Content Security Policy header
No HSTS header configured
RLS policies on nox_tasks and nox_projects use USING(true) — zero cross-org data isolation at DB level
nox-platform documents controller used @Public() decorator — document upload/management API was unauthenticated
No request size limits on file upload routes
Admin routes lack additional authorization checks
No audit logging for sensitive operations
WebSocket connections not rate-limited
No session invalidation on permission changes
API keys stored in plain text in database
~17 tables referenced in API routes have no schema SQL — RLS status unknown (workflows, automations, compensation, performance, agents, voice)
18 API routes have conditional org guard that silently degrades to no-filter when orgId is null
No brute force protection on login attempts
Org invitation tokens do not expire
Nav anchor IDs misaligned — Industries/Network/Vision scroll to wrong sections
Organization not showing after creation — user metadata not updated
Org settings page fails to load — missing organization_id in auth context
User profile/search endpoints expose data across orgs (IDOR) — no org membership check
nox_notifications INSERT policy is WITH CHECK(true) — any user can spoof notifications to other users
No output encoding on user-generated content
Missing CORS restrictions on API routes
No request logging for debugging and forensics
Cookie flags missing httpOnly attribute
No error rate monitoring or alerting
Database queries not parameterized in some routes
No dependency vulnerability scanning in CI
In-memory rate limiter resets on serverless cold starts
nox_subscriptions SELECT policy USING(true) — any user can read all org subscription/Stripe data
Excessive spacers (~1000px gaps between sections)
154
Total Routes
154
Rate Limited
120
Total Pages
120
Live Pages