Security by design
The product is designed around controlled knowledge sources, defined responsibilities, least-necessary data collection, human escalation, and reviewable workflows.
- Validated and minimized form inputs
- Server-side processing for sensitive configuration
- Environment variables for provider credentials and identifiers
- Dependency, lint, type, and production-build checks in development
- Clear separation between approved public knowledge and restricted information
Operational controls
Production deployments should add access control, audit logging, backups, incident response, secret rotation, vulnerability management, and provider risk review appropriate to the customer and use case.
Reporting a security concern
Do not include passwords, access tokens, private customer data, or exploit details in a public form. Use the contact page to request a secure reporting channel and provide a concise description of the affected component and potential impact.