Account & Sessions
Passwords are hashed with Argon2id, login state is stored in PostgreSQL server-side sessions, and the browser only holds HttpOnly, SameSite cookies. Modification requests require CSRF validation.
User Model Key
For long-term storage, use AES-256-GCM with a random nonce for authenticated encryption. The master encryption key exists only in server environment variables; logs, task content, and error messages never store the full Key.
Upload and model input
Uploaded files undergo security checks for extension, type, size, path, and compressed package. Document content is always treated as untrusted data and cannot modify system rules, access other users' data, or trigger system commands.
Report Security Issues
If you discover a security issue, contact the administrator through the support channel configured for your site. Do not include real API keys or unnecessary sensitive corporate files in your feedback.