Security.

A clear boundary around your API access.

Gateway controls

Public API traffic uses HTTPS. The application runs as a dedicated, unprivileged system service behind a reverse proxy. Machine-to-machine admin endpoints are restricted to the server and require a separate credential. The private control panel uses password authentication, expiring secure cookies, request throttling and CSRF protection. API keys can be scoped with quotas and revoked. Request bodies are bounded, concurrency is limited and generation requests have deadlines. Secrets are kept outside the public web directory.

Data handling

The application records operational metadata and usage rather than prompt or completion text. Reasoning and output pass through the service for delivery. External inference processing has separate policies; see the privacy notice. We do not claim SOC 2, HIPAA certification or end-to-end zero data retention.

Report a vulnerability

Email hello@megarider.pro with the affected endpoint and a minimal reproduction. Avoid accessing other users’ information, service disruption or unnecessary extraction. Acknowledgment and response times are not guaranteed under a public bug-bounty program; no such reward program is currently offered.

Protect your integration

Store keys server-side, rotate them if exposed, respect Retry-After and retain request IDs for troubleshooting. Ask for key revocation immediately if you suspect unauthorized access.