Security
Security starts with explicit provider gates and auditable local flows.
The current app favors scoped keys, hashed secrets, authenticated project access, and local no-send defaults while production controls are connected deliberately.
Hashed API keys
Scoped access
Signed webhooks
Provider gates
Access and tenancy
Authenticated workspace routes use Better Auth users, organizations, project membership, and owner guards. API access supports project-scoped and organization-scoped keys, with organization keys requiring an explicit project target for project data.
Secrets and API keys
REST keys are shown once, stored hashed at rest, and can be revoked from the workspace. Rate-limit and quota tables record usage without exposing raw key values back to the UI.
External systems
Live Google Search Console, provider-backed AI generation, report email delivery, object-storage delivery, and geo-IP enrichment stay disabled unless their matching enable flag and credentials are present.
Webhook posture
The local Resend webhook receiver verifies signed Svix headers before recording invite-delivery events and suppresses duplicate callback processing by storing provider event identifiers.
Review the shipped product surface.
The public docs and workspace show the local controls that back these trust statements.