Security

All provider API keys are stored server-side via environment variables and never exposed to the browser, localStorage or client JavaScript.

Authentication uses JWT with server-side verification. AI requests go through an entitlement gateway that checks subscription, limits and credits before contacting any provider.

Files are validated, scoped to your account and protected by authenticated APIs. Usage controls and rate limiting prevent abuse.

Report security issues to [email protected].