Trust

Security practices

This is a summary, not a guarantee or pentest report. Details: Source: https://github.com/Jayvy2002/prometheus-potential. See SECURITY.md.

• API keys hashed with HMAC-SHA256 and a server-side pepper. Raw keys are shown once.
• SSRF controls: scheme allowlist, credential ban, private/RFC1918/link-local/metadata block, DNS resolution check, max 3 redirects, 10s timeout, 2 MB body cap.
• Per-key and per-IP rate limits. Daily unit caps in D1.
• Security headers (CSP, HSTS, nosniff, frame deny, referrer, permissions).
• Stripe webhooks verified with the signing secret before entitlements change.
• Audit log of route, status, units, and hashed IP.
• Kill switch per key (disabled).
• Secrets live in Worker secrets, not the client bundle.

Report vulnerabilities to ruiz.jean.vincent@gmail.com. Please do not test SSRF against third-party infrastructure.