{"ok":true,"product":"BotFlow AI","environment":"production","timestamp":"2026-07-28T10:52:17.411Z","checks":{"supabase":{"ok":true,"configured":true},"whatsapp":{"ok":true,"accessTokenConfigured":true,"phoneNumberIdConfigured":true,"businessAccountIdConfigured":true,"appIdConfigured":true,"templateStatus":"APPROVED","templateLanguage":"en_US","templateCategory":"MARKETING","webhookSubscribed":true,"subscribedAppCount":2,"appWebhookConfigured":true,"appWebhookMessagesSubscribed":true,"appWebhookFields":["business_status_update","group_status_update","group_settings_update","group_participants_update","messages","message_template_status_update","phone_number_name_update","phone_number_quality_update"]},"payments":{"ok":true,"provider":"paystack","hostedCheckoutConfigured":true,"publicKeyConfigured":true,"productionReady":true,"mode":"live"},"video":{"ok":true,"provider":"d-id","providerConfigured":true,"callbackVerificationConfigured":true,"privateStorageConfigured":true,"archiveWorkerProtected":true,"storageBucket":"botflow-video"},"jwt":{"ok":true,"configured":true},"metaWebhook":{"ok":true,"verifyTokenConfigured":true,"signatureVerificationConfigured":true},"internalApi":{"ok":true,"configured":true},"popia":{"ok":true,"visible":true,"act":"Protection of Personal Information Act, 4 of 2013","controls":["privacy notice","consent-led WhatsApp onboarding","tenant data isolation","data deletion request path","audit logging"]},"securityHeaders":{"ok":true,"hsts":true,"csp":true,"frameAncestors":"none","xFrameOptions":"DENY","contentTypeOptions":"nosniff","permissionsPolicy":"camera=(), microphone=(), geolocation=()","referrerPolicy":"strict-origin-when-cross-origin"},"networkExposure":{"ok":true,"maxPublicEntryPoints":6,"publicTransportPorts":[443],"exposedPortCount":1,"approvedEntryPoints":["public website","authenticated workspace APIs","WhatsApp webhook","payment webhook","Meta embedded signup callback","AI video provider callback"]},"zeroTrust":{"ok":true,"posture":"deny-by-default","controls":["HttpOnly session cookies","tenant-scoped data APIs","internal API key required for service-to-service calls","timing-safe internal key comparison","Meta webhook signature verification","Paystack webhook signature verification","AI likeness consent records and provider callback secret","Atomic video-time reservation and failure release","rate limits on auth, assistant, onboarding, and send paths","bounded JSON request bodies","production error sanitization","fail-closed payment gate for AI execution"]}}}