# Security and access boundaries

What is protected, and how to report an issue.

## Keep credentials private

Provider secrets and service credentials belong on the server. Never put them in screenshots, public docs, browser-visible configuration or assistant prompts. Customer sign-in tokens are verified by the backend before owner-scoped data is returned.

## Reporting a concern

Contact founder@notacompanynameyet.com with a minimal reproduction and the affected page. Avoid sending secrets or another customer’s data. We do not claim certifications or a public bug-bounty program that have not been established.

## Database access model

Customer-facing requests are authenticated before server operations. Billing and new workspace-management tables deny direct anonymous and customer-role access; server operations apply ownership or membership checks. These checks do not constitute a completed independent security audit.

## Your operational responsibilities

Protect your sign-in inbox and social-provider accounts, use strong passwords, and revoke unused assistant connections. Share only the minimum sample data in reviewer accounts. Keep secrets out of recordings and public walkthrough descriptions.