Security
How we protect your keys, data, and money.
- API keys: only the SHA-256 hash is stored in the database; the secret is shown once.
- Passwords: bcrypt hashing, with sessions issued as JWTs in httpOnly cookies.
- Money and tokens: atomic database transactions, protecting against double-spend and negative balances.
- Limits: RPM/RPD per plan and per key, plus rate limiting.
- Payments: processed via YooKassa, with webhook signature verification.
- Audit logging: critical actions and administrator actions are recorded in an audit log.
Found a vulnerability? Email [email protected].