Security

Keys

• The AI key lives only in server environment variables. The browser never sees it.
• Nothing secret is written to logs or sent to Sentry; beforeSend strips auth headers.

HTTP headers

• Content-Security-Policy restricts script and style sources.
• Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin.
• X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin.

Rate limits

AI and share endpoints are rate-limited per client (Upstash Redis when configured, in-memory otherwise), 30 requests per 60 seconds by default.

Reporting

Email security@seekstar.app. You'll hear back within 90 days with a disclosure timeline.