Authority should fail closed.

Account and credential controls

Better Auth stores server-side sessions in PostgreSQL. Hosted sessions use Secure, HttpOnly, SameSite cookies. Sensitive account actions require recent authentication. Developer credentials are hashed, scoped, expiring and revocable; a credential is shown only at issuance.

OAuth uses authorization code with PKCE S256, explicit consent, resource binding, rotating refresh tokens and reuse detection. OAuth credentials are MCP-audience bound; they do not grant general REST access.

Choice and proof integrity

Leases bind candidate and context commitments. Partial commitments fail with an integrity error; legacy leases cannot mint modern portable proofs. Authority epochs end permanently when revoked. Verification separates signature validity, issuer trust and current status.

Isolation and transport

Account ownership and grant checks are applied in service and repository paths. Database schema privileges are restricted and tenant scoping is tested. Hosting provides HTTPS. Application database connections use TLS. We do not claim application-level end-to-end encryption of cultural preference records.

Report a vulnerability

Email victornnajiofor1@gmail.com with reproduction steps and the affected surface. Do not send live credentials or another person’s preference data. Please allow investigation before public disclosure.

Independent penetration testing, SOC 2 and ISO 27001 certification have not been obtained. See the Trust Center for evidence and open diligence items.