Platform security model

• Authenticated Dashboard routes and owner-scoped project data.
• Encrypted project environment storage.
• Hashed external API keys whose complete secret is shown only once.
• Paid-plan and ownership verification on every Developer API request.
• Read-only API v1 with sensitive path and payload filtering.
• Isolated Preview execution and explicit review of pending project changes.
• Protected cleanup for project and account deletion workflows.

Generated code, third-party packages, connectors, domains and user-provided credentials introduce risks outside the core account boundary. Review code and provider settings before production use, apply least-privilege credentials and report suspected vulnerabilities privately.