Security

Accounts and sessions

• Passwords are hashed with scrypt.
• Sessions use signed, httpOnly, SameSite=Lax cookies.
• Cross-origin requests that change data are rejected.
• Sign-in is throttled after 5 failed attempts.
• A password change signs out your other sessions.

Data and content

• Uploads are limited to allowed file types and 10 MB, and stored under random names.
• Files that are not images or PDFs are downloaded, never displayed in the page.
• Markdown is cleaned with DOMPurify before it is shown.
• Personal keys are stored only as SHA-256 hashes.
• GitHub webhook messages are checked with a timing-safe HMAC signature.
• Webhook secrets, API tokens and channel URLs are never shown again after saving.

Who can do what

• Roles are checked again on every request. A role change or removal takes effect on the next call.
• Deleting tickets, changing settings, inviting people, managing members and creating keys need a browser session. Keys and apps cannot do them.
• A key or app is limited to its chosen projects and cannot read others.
• A ticket in a project you cannot see returns not found, never forbidden, so its existence is not revealed.

AI app sign-in

Code exchange

PKCE with S256 is required

Authorization code

10 minutes, single use

Access token

1 hour

Refresh token

90 days, rotated on every use

If an old refresh token is reused after a 60-second retry window, Praxis treats it as theft and revokes the connection.

Policies and reporting

• Privacy policy
• Terms of service

Found a security problem? Email contact@theorem-labs.com privately. Please do not open a public issue, and give us a chance to ship a fix first.