# Security

Keep credentials, requests and listing content inside explicit trust boundaries.

- [Protect keys](/documentation/authentication): Use server-side secret storage and the narrowest scopes.
- [Log safely](/documentation/errors): Record request IDs, never credentials or raw personal data.
- [Report a vulnerability](https://luranta.com/legal/security): Use the published security contact and disclosure policy.

## Minimum controls

| Area | Control |
| --- | --- |
| Credentials | No URLs, browser storage, analytics, screenshots or support messages |
| Transport | HTTPS only; validate the API hostname |
| Content | Treat job descriptions and source text as untrusted data |
| Access | Review organisation membership and revoke stale keys |
| Diagnostics | Redact secrets before logging or sharing a request |