Two systems, two security models.

AI17Z core, on your machine

• Provider API keys and plugin credentials are sealed with AES-256-GCM under a master key kept only in your .env.
• The owner account is local and stored as a scrypt hash; there is no sign-up anywhere else.
• Every capability is typed, permissioned per agent by you, checked at ingest and again at execution, and audited.
• Outbound requests go through one bounded layer that refuses private addresses, re-judges redirects, pins DNS and caps response size.
• Installed plugins are declarations, never downloaded code.

Read the core security architecture and how to report a vulnerability.

AI17Z Studio, this service

Accounts

• Passwords are hashed with bcrypt (cost 12). Sign-in answers the same way for an unknown email and a wrong password.
• Sessions are server-side records referenced by a sealed, HttpOnly, SameSite cookie. Every sign-in creates a new session; you can see and revoke each one, and changing your password signs out every other session.
• Sign-in, sign-up and other sensitive actions are rate limited with counters held in the database.
• Every form submission is a same-origin server action; cross-site submissions are refused.
• Suspension takes effect immediately and ends every session.

Linked installations

• Linking follows the OAuth 2.0 Device Authorization Grant (RFC 8628): one-time codes, a 10-minute expiry, polling limits, and one decision per code.
• Each installation generates its own key pair; Studio stores only the public key. Tokens are bound to that key with DPoP (RFC 9449), last ten minutes, and are useless if copied. Proofs cannot be replayed.
• Revoking an installation takes effect on its next request.
• Older AI17Z builds that speak only Plugin Registry protocol v1 can use a registry key instead: stored as a hash, shown once, read-only, revocable.

Plugins and the Tool Gateway

• Publishers are verified by an admin; every version is reviewed; published versions are immutable at the database level.
• Manifests are served byte-for-byte with their SHA-256, so AI17Z can refuse anything altered in transit.
• The gateway re-checks the installation, entitlement, seat, plugin and version on every call, validates input and output against the manifest, bounds time and size, and never lets a request choose the backend address.
• Publisher credentials are sealed in Studio and never sent to a customer’s installation.

Payments

• Access is granted only after Studio reads the chain itself and finds an exact transfer — right token, amount, payer and recipient — at finality, still canonical, and never used before.
• A browser saying “sent” grants nothing. Studio never holds funds. Trading moves no funds through Studio either: an owner approves every order on their own broker or wallet, and Studio neither signs nor custodies.

What is not in place yet

• Third-party sign-in (GitHub, Google, Discord) and password reset by email are not offered, rather than offered half-built.
• Passkeys can sign you in instead of a password; a second factor required on top of a password is not yet available.
• Paid checkout stays off until it is switched on deliberately for production.

Found something? Please report it privately through the repository’s security advisories. See also Privacy.