Security
What protects your app, and where the limits still are. Machine-readable contact at /.well-known/security.txt.
Launch checks
An app goes live only after every launch check passes: approved spec, working sign-in, checkout present, no secret keys in the browser, chat that needs a signed-in user, and documents kept inside your app. The launch-check report comes with every source download.
Session controls
The dashboard security section lists active sessions with revoke, plus password change, TOTP two-factor, and device passkeys. Billing is handled by Polar; card details never touch our database.
Abuse defenses
Credential endpoints are rate-limited, contact intake carries bot protection, cookie-authenticated writes check their origin, and uploads are quota-capped per day.
Tenant isolation
Knowledge search scopes every call to one app, per-app tokens authenticate tenant traffic, and exported source strips server secrets — clients only learn whether each integration is configured.
Honest limits
Account-level login lockout and upload malware scanning are not shipped yet. They are tracked as deferred work, not silent gaps — ask us before assuming they exist.
Report an issue
Email [email protected] or use the contact form. Please do not probe other customers' apps. See also: platform status.