Security with a clear boundary.
The current account and benchmark service uses scoped access and practical controls. Architecture discussions are not audit certifications.
Account access
Passwords are salted and hashed with scrypt. Session identifiers are stored as hashes. Cookies are HttpOnly, SameSite=Lax and Secure on the deployed HTTPS service.
Authenticated writes require a session-bound CSRF token. Account data is scoped to the authenticated user; authentication and write routes are rate-limited.
Email ownership verification and automated password recovery are not implemented in this developer release. Use a unique password and do not store sensitive data.
Application boundaries
Static files come from the public site directory. The database, server modules and operational configuration are not exposed as public downloads.
The server sets content-type protection, anti-framing, referrer and browser-permission policies, plus a Content Security Policy. Request bodies and benchmark fields are validated.
The website does not accept provider API keys. Run the benchmark CLI locally when measuring an authorized provider endpoint; do not upload the key or raw sensitive prompts.
Report an issue
Use the contact page or security contact file to report a reproducible issue privately. Avoid sending credentials or other users’ information.
This release has not received a represented independent penetration test, SOC 2 certification or enterprise compliance attestation. Any commercial security requirements need a separate technical review.