You bought: A working vault

This page opens a connection, and here is exactly which one. The surface below is the official vault interface running on dev.vault.sgraph.ai, in a frame this page builds at runtime. The key does not travel in the address: the frame is opened carrying nothing, it announces itself, and only then is the read key handed over by message with the target origin pinned — so it is not in a URL, not in history, not in a referrer and not in the frame’s storage. Replies from any other origin are ignored. It is a read key, which opens a vault and cannot write to it, and sgit.ai publishes it deliberately on that vault’s own page. Every page on this site that sells anything still opens nothing at all — this is a page you reach after buying, and a build check holds that line. One exception, stated because it is real: if the handshake does not complete within twelve seconds the component falls back to opening the vault with the key in the frame’s URL fragment. A fragment is never sent to a server and never appears in a referrer, but it is in that frame’s address. The link above avoids it entirely.