Security

What actually protects your account, your organization, and your money — stated plainly, including what's still on the roadmap.

Credentials

• Passwords are hashed with scrypt (per-user salt). Nobody at Project Ares can read them. Minimum 8 characters; common passwords rejected.
• API keys (sk-ares-…) carry 192 bits of randomness — around 6×10⁵⁷ possibilities, so guessing one is not physically feasible — and are stored as SHA-256 hashes. The plaintext exists exactly once, on your screen at creation; a leaked database cannot reproduce your keys. Addresses that spray invalid keys are throttled and flagged automatically. Keys can carry an optional expiry and a monthly credit cap, and can be rolled (new secret, same key) in one click.
• Provider credentials (Anthropic, OpenAI, AWS) live only in the server's config, are managed exclusively by staff owners, and are masked everywhere in the UI.

Sessions & the console

• Browser sessions are httpOnly, SameSite cookies backed by a server-side session table — revocable one by one from Settings, all at once on password change.
• Every mutating console request is CSRF-checked (per-session token + strict Origin verification).
• Strict Content-Security-Policy, frame-ancestors none, nosniff, and HSTS in production.

Abuse resistance

• Login throttling: 10 failed attempts per email (or 30 per IP) in 15 minutes locks sign-in for 15 minutes; bursts are flagged to staff.
• Rate limits per IP globally and per account on the model endpoint.
• Anomaly flags: request-rate spikes per IP/user surface on the staff network dashboard in seconds, with IP-level traffic history.
• Spend limits cap the blast radius of a leaked key — and revocation is instant.

Accountability

• An append-only audit trail records every sensitive action — sign-ups, role changes, key creation/revocation, plan changes, staff grants — with actor, target, IP, and time.
• Usage events record who ran what, on which key, from which IP.
• Staff actions are tiered (support → admin → owner) and themselves audited. Staff owners can't be disabled from the console, and the last staff owner can't be demoted.

Honest roadmap

Security claims rot fast, so here's what is not done yet:

• Two-factor authentication — planned (TOTP first).
• Organization invite emails — invites are single-use, email-bound links; today the console shows the link to copy rather than emailing it.
• SSO / SAML — on the enterprise track.

Payments are fully live: credit purchases through Stripe (signature-verified webhooks, idempotent crediting) and real subscription charging — prorated starts, monthly renewals, dunning with a grace window, and exactly-once collection guarantees.