Security and privacy (public documentation)
Technical SEO and public docs must not expose credentials, customer graphs, or admin surfaces. This page states operational expectations already implied by the product docs.
What is public
Architecture, Cypher subset, APIs, demo Docker compose, and synthetic fraud examples (cards, merchants, devices) are public so developers and crawlers can understand the product.
What must stay private
- Production credentials, API keys, and Bolt passwords
- Customer graphs, PAN/PII, and live fraud labels
- Admin reset switches, internal metrics backends, unpublished repos
- Private datasets used for unpublished benchmarks
The demo compose may set ENABLE_ADMIN_RESET=true for local exploration. Do not copy that into a production internet-facing deployment.
Demo Bolt auth
Documentation uses empty Bolt username/password for local demo. That is not a production authentication model. Put JetGraph behind your network controls and apply real auth in production.
robots.txt is not a security control
Public crawlers are allowed to index documentation. Private admin UIs and APIs must be protected at the application and network layer, not by hoping they stay out of a sitemap.