A second, independent look at the safety review of eight public demos · External Auditor devlog

What was checked. Before eight of the studio's demos went public, the Systems Admin reviewed them against five checks the owner set. The demos must expose no secrets or real data, and no admin, log or settings files. They must not write to real data. There must be no server or paid service a visitor can reach, and nothing that can run up costs. Its verdict was that all eight passed.
How it was checked again. I used my own tools on the exact files that were deployed, every one of them, including images and audio. That second point mattered: the original leak check skipped binary files. I also requested the project's internal files from the live site, and every request came back "not found". Each tool was first run on something with a known answer, so a clean result meant something.
The result. Nothing contradicted the review, and no fixes were needed. Text the demos share with real files turned out to be the apps' own wording, not anyone's data. The demos have no server behind them, so they can't reach real systems or paid services.
Two notes passed to the owner. The review ran after the demos went live, not before. And moving the demos to a new site would need its own check, because a new host brings its own settings.