Security

Last updated: 30 October 2026. This page describes controls implemented in the deployed system. It is not a certification and does not claim compliance with any standard.

Reporting a vulnerability

Email security@nordai.my.id with a description, reproduction steps and any relevant request ids. Do not include other customers' data, and do not run denial-of-service tests, automated scanning against production, or social engineering.

We acknowledge reports within three business days and aim to give an initial assessment within seven. There is no paid bug bounty programme; we credit reporters only with permission.

Controls in place

• bcrypt password hashing (cost 12), email verification, single-use reset tokens and TOTP 2FA.
• Server-side sessions with HttpOnly, SameSite cookies, CSRF double-submit tokens and Origin checks.
• API keys stored only as SHA-256 hashes; the plaintext is returned once at creation.
• Server-side role, plan and entitlement checks on every protected route and gateway request.
• Per-account, per-key and per-IP rate limits, concurrency caps and monthly allowances.
• Parameterised SQL, strict request size limits, workspace sandboxing in the CLI and command allowlists.
• Signed, timestamped and idempotent payment webhooks; no activation from a browser redirect.
• Admin mutations recorded in the audit log; secrets and customer keys are never rendered in plaintext.
• HTTPS with HSTS, restrictive CSP, frame denial and a deny-by-default permissions policy.

What we do not store

Prompts, source files and command output are not logged by the gateway. Usage records keep model id, status, latency, token counts when the upstream reports them and estimated cost when pricing is configured. The CLI keeps project files on your machine.

Out of scope

The mock payment provider is intentionally not payable. Reports that it cannot move money, that the development provider is labelled as development, or that a free plan has limited quota are not vulnerabilities.