Updated 2026-05-31
Security
Security posture, reporting channel, and launch-readiness baseline for PRAXIS.
This page states the current PRAXIS beta operating posture. Enterprise-specific terms, residency, or procurement language require a separate written agreement.
Security Baseline
PRAXIS keeps provider keys, Firebase Admin credentials, cookie-signing secrets, user-key master secrets, and billing secrets server-side only.
The production boundary is Next.js on Cloud Run, private backend services, Firebase Auth, Firestore and Storage rules, Cloud SQL for runtime ledgers, Secret Manager, and service-to-service OIDC.
User API Keys
User-supplied provider credentials are handled through server-side API routes and encrypted storage. Status APIs must not return plaintext secrets.
If any provider credential is exposed, rotate it immediately and report the exposure.
Reporting
Report suspected vulnerabilities to security@tacitus.me with reproduction steps, affected routes, and expected impact.
Critical reports involving active exploitation, auth bypass, exfiltration, or public secret exposure are treated as urgent incidents.