pcbx.ai · security
Security
How pcbx protects accounts and design artifacts on https://pcbx.ai. Report vulnerabilities to security@pcbx.ai. Please do not file public issues with exploit details.
1. Transport and cookies
The site is served over HTTPS on pcbx.ai (Cloudflare). Session cookies are HttpOnly and Secure on HTTPS, SameSite=Lax. www.pcbx.ai redirects to pcbx.ai.
2. Secrets and tokens
OAuth client secrets live in Worker secrets, not in the SPA. GitHub user access tokens used for ingest stay on the server (Better Auth account store) and are stripped from API JSON. We do not log tokens.
3. Isolation
The Cloudflare Worker does not run the native rsci compiler in V8. Hardware jobs are enqueued for a runner. Identity tables (Better Auth) and platform tables (projects, jobs) use separate D1 databases.
4. Reporting
Email security@pcbx.ai. Include the URL, a brief description, and whether personal data is involved. We will acknowledge when we can. Do not test in a way that degrades the service for other users.
中文摘要
1. 传输与密钥
站点经 HTTPS 与 Cloudflare 提供。会话 Cookie 为 HttpOnly。OAuth 密钥与 GitHub ingest token 不进入前端。漏洞请发 security@pcbx.ai，不要公开利用细节。