# Outreach Playbook

AI App Exposure Desk outreach must be respectful, accurate, and low-pressure.

## Rules

- Human approval is the default mode. Auto-send can be enabled only through `OUTREACH_MODE=auto` after the copy, suppression process, and contact discovery rules are reviewed.
- Say "public exposure signals" or "production-readiness risk."
- Do not use compromise claims.
- Do not imply private access.
- Do not include sensitive values.
- Do not include exploit steps.
- Offer a safe high-level SignalCheck summary and a paid Public Surface Review.
- Stop outreach if the owner asks not to be contacted.

## Agent Flow

1. Public search APIs find candidate AI-built app surfaces.
2. Passive triage checks public HTML, headers, same-origin scripts, robots, sitemap hints, and public contact pages.
3. Gemini drafts outreach from redacted deterministic facts.
4. Drafts are stored in D1 for approval or sent automatically only when `OUTREACH_MODE=auto`.
5. Replies are ingested by webhook, classified by Gemini, and moved into tasks.

## Safe Email Template

Subject: Public app readiness signal for [Company/App]

Hi [Name],

I run Cyber Craft Solutions and built AI App Exposure Desk for founders and agencies shipping AI-built apps quickly.

During passive public-surface review, our agent found broad public exposure signals for [App/Domain]. We did not log in, click exports, probe private APIs, or exploit anything. This is a production-readiness signal that may be worth checking before the app handles more customer data.

If helpful, I can run a Public Surface Review that documents the exact public findings safely and gives you a prioritized fix list.

Thanks,
Cyber Craft Solutions

## Approval Checklist

- Domain owner or contact looks relevant.
- Evidence is public and owner-safe.
- No sensitive values included.
- No exploit steps included.
- Language avoids compromise claims.
- Suppression list was checked.
- Outreach approval or auto-send event is logged.