Security
Security
How the workspace, keys, and engines are gated.
Authentication. Workspace sessions use an HMAC cookie. Optional Supabase email verification sits in front of plan selection. Password re-entry is required to mint or revoke a live key.
API. POST /api/watermark/generate and /validate require Authorization: Bearer sam_live_…. Hashed keys are compared; unknown tokens return 401. Cross-site browser calls may only request Shield generate. Enterprise generate belongs on your backend.
Fonts. GET /api/watermark/font/*.woff2 is unauthenticated; the glyph map lives in the URL token. Treat font URLs as secrets for that issue.
Transport and store. TLS on production. Tenant usage, hashed keys, and seal tracking ids persist in Postgres when configured, else a local file store. Document bodies are processed in memory for the request and are not written to seals_issued.
Reports. Validate returns an HMAC-SHA256 signed attribution record. POST /api/watermark/report returns a printable HTML view of that record. Neither is an affidavit.
Contact. security@secretsam.com