Server-only secrets
Provider, database, billing, and AI credentials are never included in browser bundles.
Trust centre
Security is an operating constraint.
The platform separates provider credentials, customer identity, billing state, prediction records, and public delivery surfaces.
Controls in the current architecture
Signed billing events
Stripe webhook signatures are verified and event identities are recorded idempotently.
Hashed API keys
Syndicate keys are displayed once and persisted as SHA-256 hashes.
Least-data generation
AI prompts contain normalized race inputs, not provider credentials or customer billing details.
Rate and budget controls
Account quotas, request limits, and AI spending ceilings constrain automated usage.
Immutable analysis identity
Input hashes, model IDs, prompt versions, and generation times make records auditable.
Responsible disclosure
Do not include credentials, personal information, or exploit payloads in public channels. A dedicated external vulnerability-intake address has not yet been published; until it is, avoid testing production beyond your own account and normal documented interfaces.
Scope limits
No website can make an absolute security guarantee. This page documents intended controls, not a certification, penetration-test claim, bug-bounty programme, or promise that every class of vulnerability has been eliminated.