Security

Built to limit access

This local build has not received a production security audit. Production use needs the configuration below and an operator review.

Production setup

Production refuses to start without an HTTPS public origin, a configured OIDC issuer and HTTPS JWKS endpoint, a fixed audience, required product scopes, a valid Fernet key, and strong tenant and session signing keys. Browser access uses authorization code with PKCE and a server-side session. MCP calls verify signed JWTs and enforce product scopes.

Request boundaries

The service checks the request host and origin, does not enable cross-origin sharing, limits request sizes and records, and limits concurrent analysis and per-account request rate. Web pages use a strict content security policy and load no third-party scripts or fonts.

Files and saved memory

Uploaded data is held only in memory during the request. Source Memory payloads are encrypted at rest, account-scoped, version-checked, and exported or deleted only for the verified account. Its configured database file is created with restrictive permissions.

Payments

Stripe is optional and disabled unless all required credentials and known server-side price IDs are configured. Signed webhook events are deduplicated and stale subscription events cannot replace newer account status.

Limits

These safeguards reduce exposure but do not make a claim that the service is vulnerability-free or fully audited. Configure TLS termination and trusted proxy headers correctly, protect runtime secrets, and review provider-specific identity and payment settings before production.