Skip to content

Security: anwhelan01/cadence

Security

SECURITY.md

Security

  • XAI_API_KEY is server-only. Read it in createServerFn handlers. Never expose it as VITE_XAI_API_KEY or return it from an API response.
  • The in-house editor is user-initiated and capped (max_tokens: 700). Do not add automatic or per-visitor generation loops — the key belongs to the app owner and every call spends their quota.
  • Cadence stores studio state in localStorage (cadence-v1). Do not persist personal data from real fans in an unauthenticated build. The seeded names are fictional.
  • Report vulnerabilities privately to the repository owner rather than opening a public issue with an exploit attached.

There aren't any published security advisories