Security

Data in Transit & at Rest

All traffic between your browser and CosmicAI is encrypted using industry-standard TLS. Sensitive data is encrypted at rest by our infrastructure providers.

Authentication

We support trusted OAuth sign-in (Google, Apple, and X) so your credentials are never stored by us. Your session and refresh tokens are delivered only as Secure, HTTP-only cookies that JavaScript cannot read, so they can't be stolen by cross-site scripting.

Least-Privilege Access

Internal access to systems and data is restricted on a need-to-know basis, and provider API keys are kept server-side and never exposed to the browser.

Reporting a Vulnerability (Responsible Disclosure)

If you believe you've found a security issue, please email [email protected] with steps to reproduce. Our machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

• Report privately and give us a reasonable time (up to 90 days) to fix the issue before any public disclosure.
• Only test against your own account and data; never access, modify, or delete other users' data, and avoid anything that degrades the service for others.
• We will acknowledge your report, keep you informed of progress, and credit you if you'd like once the issue is fixed.
• We will not pursue legal action against good-faith security research that follows these guidelines. We do not currently run a paid bug-bounty program.

For more on how we handle data, see our Privacy Policy.