Security

Credentials

• Passwords are hashed with bcrypt (cost 12).
• API keys are 192-bit random values, stored only as SHA-256 hashes, shown once at creation.
• Sessions are HttpOnly, SameSite=Lax, Secure cookies signed with HS256.

Payments

All card handling happens on Stripe Checkout (PCI DSS SAQ-A scope). Credits are applied only after Stripe's signed webhook confirms payment, with replay-safe idempotency.

Platform

• TLS everywhere in production; HSTS enabled.
• Strict security headers (CSP, frame-ancestors none, nosniff).
• Per-key rate limits and optional per-key monthly spend caps.
• Prompt/completion content is not persisted by the gateway.

Responsible disclosure

Found a vulnerability? Email the operator with reproduction steps. Please avoid testing against other customers' data; use your own account.