Security

Security

Production baseline

• Use HTTPS and restrict CORS to the exact public origin.
• Keep PostgreSQL, MongoDB, the Python AI service, and the update agent off the public interface; proxy browser requests through the same origin.
• Store database, encryption, model, payment, OAuth, and Airtable secrets in server-side environment or a secret manager. Never commit them.
• Set OPENBCON_RUNTIME_ENV=production for the Python service. It then requires the Node-issued HttpOnly session cookie and checks application workspace access.
• Keep OPENBCON_ALLOW_PRIVATE_AI_ENDPOINTS=false unless a private endpoint is explicitly required and separately network-restricted.
• Back up databases, protect backups, and rotate credentials after suspected exposure.

Authentication and authorization

Browser sessions are stored server-side and represented by an HttpOnly bconomics_session cookie. Platform configuration changes require an administrator role. Application and generation requests are scoped to the active workspace, so a supplied public app_id cannot be used to read another workspace's record.

Reporting a vulnerability

Do not open a public issue for a suspected vulnerability. Email security@bconomics.ai with the affected component, reproduction steps, expected impact, and any suggested mitigation. See the repository's security policy.