Security & Trust

1. Authentication & Rate Limiting

We use Firebase Auth for human access and SHA-256 hashed API keys for machines. Tools are subject to strict 60 RPM rate limits.

2. SSRF Protection & Execution

All tool proxy endpoints validate destination URLs against private/internal IP ranges to prevent SSRF exploitation. Tool calls are proxied securely through the platform.

3. Financial Rails & Auditing

We use atomic Firestore transactions for settlement. Callers are only charged upon a successful tool execution. Execution hashes are stored to maintain an audit trail.

4. Anomalous Traffic Detection

We apply basic heuristic detection for Anomalous Traffic patterns. Note: This acts as an initial filter and is not a complete guarantee against sophisticated attacks.

5. Secrets Management & Vulnerabilities

API keys are generated and displayed only once. They are securely stored as SHA-256 hashes. Please report any security vulnerabilities to [email protected].