Repository separation
Public website code, demo facade and real assurance infrastructure are separate trust domains.
Security practices
Secure defaults for the commercial ecosystem.
Secrets out of source control
Deployment and integration secrets are expected through environment or managed secret mechanisms, not frontend assets.
Fail closed
The website does not turn a failed demo backend into a claim of success or silently route users toward production systems.