Inspect the state boundary.

StatePort is designed for reviewable local-first application state. The point is not to move everything; it is to make the useful context explicit before you reopen it.

Before reuse

InspectCaptured context

ExcludeMaterial outside the boundary

OpenCurrent localhost

Portable state. Separate authentication.

Inspect what is captured. Know what is excluded. Sensitive values are excluded by default; a supported protected value is retained only when you explicitly choose it, only through an OS-protected machine-local boundary, and only with your explicit authorization on each reproduction run.

Review is part of the workflow.

The State Card should make a developer's starting point easier to reason about, not hide its boundary behind a black box.

Inspect the capture before it becomes reusable.

Treat the saved application context as something to review, with exclusions visible alongside the useful state.

Credentials stay separate by default.

Sensitive values are excluded by default. Retaining a supported protected value is an explicit local choice, and ordinary sharing stays unavailable while a reproduction still requires it. Discard it instead, and the Journey gains a manual barrier for the missing step.

A protected handoff is a separate, explicit choice.

Where the installed build includes this capability, an eligible authenticated session can be sent only through a separately encrypted Protected Persona flow: the sender selects and confirms it, the recipient reviews safe scope and expiry details, and acceptance installs it into recipient-local protected storage. Card-only import remains available.

Bring the bug to localhost — not production access.

The product is built around local development work and explicit dependency policy, not access to a customer's production system.

What stays outside an ordinary State Capsule.

The capture boundary is deliberate. A useful saved setup is not an export of every browser or authentication detail around it, and a retained protected value never leaves your device through an ordinary share.

Authorization, Cookie, and API key headers, raw cookies, access or refresh tokens, full browser profiles, other tabs/history, and file-upload bodies stay outside an ordinary portable State Capsule. Explicit local retention and a separately encrypted protected transfer use separate policy-controlled storage; neither turns the ordinary Card into a credential bundle.

In saved-material replay, the captured source origin stays blocked and an unmatched in-scope request is blocked and recorded without hidden live fallback. The remaining attempt may continue, and its actual checkpoint/state determines the outcome.

Read the current Beta scope

The website has a boundary too.

Public marketing pages do not require a StatePort account. The browser is never the authority for a future purchase or entitlement.

Browser inputUntrusted until verified.

Portable stateReviewed before reuse.

Future commerceServer-verified when enabled.

Useful state deserves a visible boundary.

Security is a set of explicit constraints and review points. Keep the useful context close to local development, and know where it stops.

See the local-first workflow