Security
Built to reduce risk, not pretend risk is zero.
No SaaS can truthfully guarantee that it will never be hacked. KryxAI uses layered controls so a single mistake is less likely to expose accounts, credentials or user work.
Browser hardening
Security headers restrict framing, MIME sniffing, referrer leakage, dangerous browser capabilities and insecure transport.
Authenticated workspace routes
Dashboard and private API routes are session-gated before application logic runs. Webhooks and machine endpoints authenticate through their own route-specific controls.
Abuse and cost controls
High-risk and high-cost actions use server-side validation and rate limits so one client cannot freely hammer model or action endpoints.
Server-side secrets
Private service credentials belong on the server side. UI code should receive only the minimum data needed to render the product.
Fail closed, then report
Security-sensitive failures should return a clear error rather than silently inventing success. Suspicious behavior is treated as a bug, not a feature.
Responsible disclosure
If you find a security issue, do not access data that is not yours and do not intentionally disrupt the service. Use the support contact published in the footer.