Transport and access
Use HTTPS for production traffic. Authenticated application areas are protected by Clerk, and Laravel requests should flow through the live-auth proxy where session context is required.
Security
Security
Last updated: May 14, 2026
Security is part of the product architecture. This page describes practical controls without claiming certifications that are not published.
API key handling
API keys and provider secrets must be stored server-side and never committed to the repository or exposed in browser code.
Audio handling
Uploaded audio and generated files should be handled with access control, retention limits, and clear deletion practices appropriate to the plan and workflow.
Security contact
Report suspected vulnerabilities, account compromise, or abuse through the contact/support channel with enough detail to reproduce the issue.