Security

Application layer

• Strict Content-Security-Policy, HSTS and Referrer-Policy on every response.
• Per-IP rate limits on public endpoints, with an abuse log for repeat offenders.
• Webhook signature verification plus replay protection via a processed-events table.
• All secrets live server-side only and are never shipped to the browser.

Data layer

• Row-Level Security is enabled on every user table — no table is readable without a matching policy.
• Roles live in a dedicated user_roles table behind a SECURITY DEFINER has_role() function. Roles are never trusted from the client.
• Payment approval tokens are excluded from client-readable columns.
• Internal email-queue functions are restricted to the service role.

Auth

• Email and Google OAuth. Anonymous sign-ups are disabled.
• OAuth redirect_uri is pinned to the same origin.
• Sessions refresh automatically and degrade safely when storage is blocked.

Model data handling

Prompts and generations are not used to train models. Outputs are generated per request and stored only where you explicitly save them (conversations, saved schemas, agents).