Implemented controls and current boundaries.

• Supabase manages browser authentication and secure session cookies.
• Dashboard-to-Worker requests use short-lived signed assertions with a shared secret and explicit issuer.
• Customer API keys use the krx_... format and authenticate with Authorization: Bearer <key>.
• API keys are high-entropy random values stored as bcrypt hashes. Plaintext is shown only when the key is created.
• Resource handlers check customer ownership before returning sites, deploys, files, domains, teams, or webhooks.

• Browser, API, and hosted-site traffic uses HTTPS.
• Cloudflare R2 stores deployed content with provider-managed encryption at rest.
• Supabase stores account and deployment metadata in Postgres with service-role access restricted to server processes.
• Application secrets are supplied through Vercel or Wrangler environment secret stores and are not committed to source control.
• The web application applies CSP, clickjacking, referrer, and browser-permission headers as defence in depth.

• Authentication failures, sign-up, key creation, and other sensitive routes are rate-limited.
• Deploy and key-creation requests use idempotency or atomic storage paths where supported.
• Webhook targets are restricted to HTTPS and screened against local, private, link-local, and reserved network ranges.
• Administrative customer access is read-only, time-limited, customer-notified, and audit-logged.

• Krexel does not currently claim SOC 2, ISO 27001, PCI merchant storage, or a formal uptime SLA.
• Remote MCP access uses OAuth 2.1 discovery, PKCE, audience-bound tokens, and explicit user consent.
• New custom-domain attachment is paused while hostname routing and certificate handling are replaced.
• No public bug-bounty programme or bounty range is promised.

Email security@krexel.comwith the affected URL, impact, reproduction steps, and a safe way to contact you. Do not access another customer's data, degrade the service, or publish an unresolved issue before coordination.