Security

Passwords are hashed; session cookies are essential, HttpOnly and Secure in production. You can enable authenticator-app two-factor authentication, save one-use recovery codes and revoke other sessions from Account settings. Account linking between identity providers is disabled. Security-sensitive operations require the authentication library’s recent-session checks or current password verification.

The service uses account ownership checks, same-origin controls, request-size limits, persistent rate limits, public-URL validation, restrictions on private-network source fetching, security response headers and bounded document parsing. AI calls use spending reservations and saved checkpoints. These controls reduce risk; they are not a claim of external certification or a guarantee that no vulnerability exists.

Do not send passwords, authenticator secrets, recovery codes, provider keys or complete confidential datasets. Use the public operator contact below once configured, or an account support request. Include a minimal reproduction and request reference. Do not access other people’s data, interrupt the service or publish private data while reporting a problem.

This service is preparing for commercial launch. Provider configuration, email recovery, payment arrangements, backup retention and the operator’s public legal details must be checked before paying customers are admitted. The operator readiness checklist is maintained separately; this page is not a security audit attestation.