Security at Vequro

A plain-language overview of the current platform design.

Account isolation

Projects, Lukas sessions and related owner-scoped data are checked server-side before access. Public app routes are separate from private workspace routes.

Provider credentials

Vequro is designed to keep AI provider and payment secrets on the server. Generated browser apps should not receive secret API keys.

Publishing control

Publishing pins a saved project version. Editing a draft does not automatically replace the version currently live.

Payment separation

Vequro's subscription billing is separate from Stripe Connect merchant payment flows used by customer apps.

Custom domains

Domain state should only be shown as verified and SSL-active after the configured provider confirms those states.

Responsible disclosure

A dedicated public security contact should be added before broad commercial launch so researchers and customers have a clear place to report suspected vulnerabilities.