Updated 2026-09-30
Security
Security posture, reporting channel, and current launch-readiness baseline for PRAXIS.
PRAXIS is part of TACITUS, an independent experimental project operated by Giulio Catanzariti. No TACITUS legal entity has been incorporated. Institutional terms, data handling and contracting parties must be established before an evaluation. Nothing on this page excludes rights or liabilities that applicable law does not allow to be excluded.
Security Baseline
PRAXIS keeps provider keys, Firebase Admin credentials, cookie-signing secrets, user-key master secrets, and billing secrets server-side only.
The production boundary is Next.js on Cloud Run, private backend services, Firebase Auth, Firestore and Storage rules, Cloud SQL for runtime ledgers, Secret Manager, and service-to-service OIDC.
User API Keys
User-supplied provider credentials are handled through server-side API routes and encrypted storage. Status APIs must not return plaintext secrets.
If any provider credential is exposed, rotate it immediately and report the exposure.
Scope of the Beta
Working sign-in, protected routes and reviewed release journeys do not establish an independent security certification or acceptance of every account, sharing and institutional workflow.
SSO, organization roles, residency, private deployment, complete erasure and recovery commitments must be verified for their actual configured path before an institutional engagement relies on them.
Reporting
Report suspected vulnerabilities to security@tacitus.me with reproduction steps, affected routes, and expected impact.
Critical reports involving active exploitation, auth bypass, exfiltration, or public secret exposure are treated as urgent incidents.