Self-Assessed Security Report

All dashboard and API routes protected via Clerk session middleware. Supabase RLS enforced on all tables. Admin routes additionally gated by ADMIN_USER_IDS env var. Cron and webhook endpoints use timingSafeEqual token comparison. No unauthenticated access to user data confirmed.

Provider API keys encrypted at rest with AES-256-GCM (ENCRYPTION_KEY in Vercel, never in code). PromptUnit API keys stored as HMAC-SHA256 hashes — raw key is unrecoverable from the database. timingSafeEqual used on all secret comparisons (cron tokens, webhook tokens). TLS enforced in transit by Vercel edge.

All database queries use the Supabase JavaScript SDK with parameterized calls — no raw SQL concatenation anywhere. Blog HTML is generated by remark-html from markdown files committed to the repository (author-controlled only, not user input). No eval() or Function() constructor found in the codebase.

Routing is opt-in after 14-day observation period — no traffic is modified without explicit user action. Billing model (20% of verified savings) removes any incentive for the system to route incorrectly. Spend circuit breaker enforces hourly and daily hard limits per organization.

CORS wildcard is intentional on /api/proxy/* routes — customers call the proxy from their own web apps and the PromptUnit key is a server-side secret, not a browser credential. This is documented in a code comment. All environment secrets are in Vercel — none hardcoded. No debug or admin endpoints exposed without authentication.

4 HIGH (Clerk) fixed during this audit. 6 MODERATE remaining — all in transitive dependencies not present in the production code path (see npm audit table above). No critical vulnerabilities remain. Accepted risk is documented per finding.

Authentication delegated to Clerk (production mode). Session tokens managed by Clerk — not stored in local state or localStorage. Rate limiting enforced on all proxy routes via checkRateLimit(). No credential enumeration vector identified.

No eval(), no CDN-hosted scripts without integrity attributes, no deserialization of untrusted data. Build pipeline runs on Vercel from a locked package-lock.json. No dynamic code execution paths identified.

Every proxy call is logged to Supabase (model, cost, latency, routing decision, task type). BetterStack monitors /api/health every 60 seconds with alerting to igal@promptunit.ai. Admin alert email triggered on BetterStack downtime webhook. Security audit routine runs every 4 days via Claude CCR.

All upstream provider URLs are derived from a hardcoded map in provider-endpoints.ts — no user-supplied URL is ever fetched. The proxy accepts a model name from the request body, maps it to a known provider endpoint internally, and rejects any model not in the known list.