Security

Identity and account scope

Authentication is handled by Auth0. Product accounts, entitlements, artifacts, usage, and audit events are separated by an account-scoped subject and product identifier. Server-side checks enforce the boundary before an action is enabled.

API keys

Product keys are shown once, stored only as a digest, scoped to one product account, and revocable. Customers should store keys in a secret manager or local process environment and never in browser code, prompts, source control, screenshots, or shared configuration.

Payments

Checkout and billing-portal sessions are created server-side and completed on Stripe-hosted pages. Signed webhooks update entitlement state; card details are not stored by the product.

Transport and browser controls

Production pages use HTTPS, a restrictive content security policy, anti-framing headers, MIME-sniffing protection, a strict referrer policy, and disabled access to unnecessary browser sensors.

Monitoring and response

Request IDs, status codes, latency, bounded usage events, and audit actions support troubleshooting without logging credentials or arbitrary payloads. Customers should revoke a potentially exposed key immediately and use their account support channel to report a suspected vulnerability.