Neu Software LLC
Security
How Overbrilliant approaches account safety, token handling, hosted model routes, payments, and vulnerability reports.
Security model
OB-1 combines local developer tooling with hosted services for authentication, model routing, usage metering, search, billing, and account management.
The CLI should be run from repositories you trust. Review file changes and command output before committing or deploying.
Controls
- CLI tokens are high-entropy bearer tokens and are hashed at rest on the server.
- Hosted provider keys are kept server-side so they do not need to ship in the open-source CLI.
- Sessions are signed, billing webhooks are verified, and processed webhook events are stored for idempotency.
- SQLite-backed state uses migrations and usage records to keep plan, token, and billing state auditable.
- Paid search and model routes can be gated by plan, usage, and abuse controls.
Your responsibilities
- Keep your machine, repository, CLI token, package manager, and shell environment secure.
- Do not paste secrets or regulated data into prompts unless you have verified the destination and authorization.
- Revoke tokens if a device, repository, log, or credential may have been exposed.
Vulnerability reports
Send vulnerability reports to [email protected]. Include the affected component, steps to reproduce, impact, and whether any data may have been accessed.
Please avoid privacy violations, data destruction, persistence, service disruption, and public disclosure before we have had a reasonable chance to investigate.