Security

Implemented controls and limits.

VeriTrust routes read provider tokens and the Supabase service-role credential from server environment variables. The project does not claim an independent penetration test, security certification, or guaranteed protection against every attack.

Secret Handling

The runtime expects Hugging Face tokens and model repository paths, the Supabase service-role credential, webhook encryption keys, and the optional admin secret in server-only deployment environment variables. Provider model paths are redacted from API responses and public reports. Deployers are responsible for configuring, restricting, and rotating these values.

API Key Storage

Developer API keys are returned once and stored as SHA-256 hashes with a prefix, masked value, scopes, status, timestamps, and usage limit. Revocation changes the stored status so later authentication fails.

Server and Workspace Controls

Implemented routes apply authenticated workspace or scoped-key authorization, fail-closed quota checks, request-size limits, image signature validation, origin checks, no-store API responses, and sanitized error responses. Production responses also set a restrictive content security policy, transport security, frame denial, and browser capability restrictions. Supabase row-level policies scope workspace records when the production schema is applied.

Safe Use

Browser sessions use server-managed, HttpOnly, SameSite cookies so access and refresh tokens are not readable by page JavaScript. The cookies are session-scoped and marked Secure in production. Use developer keys only from trusted backends or private automation, keep dependencies and credentials maintained, and verify suspicious content through official channels before action. Model output is not a substitute for incident response or forensic analysis.