We exercised the running review API with a real local database. Guest requests carried no account credentials. All generated test records were removed afterward.
Observed in local verificationNew accounts start on Free with 10 GB of base storage.
A new user record defaulted to Free and resolved to 10 GB, with no subscription or payment record created. This checks the account defaults, not the complete signup flow.
See plan options and the signup form. Confirm paid prices at checkout before upgrading.
Observed in local verificationA recipient can open an active review link without an account.
The running public API returned the shared version with HTTP 200 to a request with no cookies or Authorization header. Video playback was not part of this API check.
Observed in local verificationGuests can post timestamped feedback when guest comments are enabled.
A request with no account credentials saved a comment at 18 seconds, returned HTTP 201, and the comment list returned the same timestamp. The guest received an assigned name and avatar.
Observed in local verificationGuests receive an assigned identity rather than entering a name.
Two comments with the same visitor identifier on one version received the same assigned guest name. The request supplied no name or email. A visitor identifier is stored, so this is not a claim of untraceable anonymity.
Observed in local verificationGuest commenting is optional and off by default.
A link created with the default setting opened successfully but rejected a guest comment with HTTP 403. It could still read the version’s existing comments; disabling guest posting does not hide feedback.
Observed in local verificationEach review link and its feedback belong to a specific version.
With v1 and v2 in the same project, the original link still returned v1. The v2 link returned v2 with no v1 comments. A second link to v1 could read v1’s existing comments.
Observed in local verificationRevoking a link blocks later requests through that link.
After invoking the product’s revoke handler, the running public API rejected version access (410), comment reads (404), and new comments (404). Another link remained active. This does not test media URLs, already-open sessions, downloads, or the owner authorization layer.