Security
Last updated: October 7, 2026
How We Protect Your Account
- Passwords are stored as bcrypt hashes.
- Sessions use short-lived access tokens and rotating refresh tokens in HttpOnly cookies.
- State-changing requests are protected with a CSRF token.
- Repeated failed sign-ins on an account trigger a temporary lockout that lengthens with further failures.
- Passkey (WebAuthn) sign-in is available under Settings → Security.
- We email you when your password is reset or a passkey is added or removed.
- AI Connector connections can be revoked at any time, and replaying a rotated-out connector refresh token revokes the connection.
- Lab code runs in sandboxed containers separate from the application.
Reporting a Vulnerability
A security contact is not configured on this deployment. Report vulnerabilities through the in-app support ticket system.