From 1b09e0f1f9e470fc88323298a7d5ef38d4eba33b Mon Sep 17 00:00:00 2001 From: Pradip Nichite <9526749+PradipNichite@users.noreply.github.com> Date: Thu, 22 Oct 2026 20:56:12 +0530 Subject: [PATCH] docs: replace outdated hosted key-isolation limit with the verified scope Hosted accounts now have an explicit own-or-platform key source; the README still listed provider-key isolation as separate work. State what was verified (one bounded hosted journey) and what was not (load, multi-tenant security). Also document that MySQL connections are accepted on port 3306 only. Co-Authored-By: Claude Opus 5.5 --- README.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 97c7785..a88e518 100644 --- a/README.md +++ b/README.md @@ -141,16 +141,23 @@ requires HTTPS, matching login origin, secure cookies, and private datastores. Use read-only source credentials: the existing execution path is not a general SQL sandbox. Review generated queries and results. Query-time descriptions do -not automatically include PostgreSQL table comments. +not automatically include PostgreSQL table comments. PostgreSQL connections +accept any TCP port; MySQL connections are accepted on port 3306 only. Flat and nested stacked-bar responses render through the same live and saved conversation path. Stacked charts preserve individual series values, explicit zeros and missing series. Invalid segmented data shows an explanation while the supplied Data, Query and Raw views remain available. -Standalone login is for one operator. Broader hosted provider-key isolation, -shared website widget assets, and the retired external report-consumer lane -remain separate work. The in-process report option is included. Targeted +Standalone login is for one operator. On the hosted service (2026-10-22), each +account uses either its own provider keys or the platform key, set per account. +An account on its own keys uses them for setup, questions, charts and +embeddings, and gets a clear error, with no fallback to the platform key, when +its key is missing. That was verified on one bounded hosted journey: one +answered and one refused question, using a temporary key. It is not a load or +multi-tenant security assessment. Shared website widget assets and the retired +external report-consumer lane remain separate work. The in-process report +option is included. Targeted installation checks do not establish general benchmark accuracy or load capacity. ## License and provenance