Security

💯Epic Tech AI🔥™️ · no hardcoded API keys in the Chamber source that ships

BYOK or pay

Provider keys are stored in localStorage on your machine, never in git, never as Wrangler plaintext. If a key header is present (≥12 chars), the job is billed: byok and no Chamber credit is taken. If not, the Gate session must exist and the user db must have enough credits or the API returns 402.

Generate calls send BYOK only as a request header. We do not persist it. Credit decrements are on your ChamberUser SQLite row, not on a shared pool.

Session codes

Email OTP is hashed (SHA-256) before storage. Raw codes are not written to Durable Object tables. Codes expire. Start is rate-limited per inbox.

Payments

Stripe Checkout uses a Worker secret, never a key in git. $0.99 = 10 credits, written only after we retrieve a paid Checkout session. Session ids are stored so a reload cannot double-credit.

Transport

HTTPS on chamber.epictechai.app. Security headers: nosniff, frame deny, referrer strict-origin. Session cookie: HttpOnly, Secure, SameSite=Lax.

What this is not

Not a pentest certificate. Not SOC 2. Not “unhackable.” Report abuse through the product; do not file fake “we are FDIC insured” claims — we are not a bank.