Security Overview

1. Accounts and sessions

• Sessions are signed tokens issued only after you prove ownership of your email: a password check, an emailed reset link that expires after one hour, or a verified Supabase sign-in.
• Resetting your password signs out every other device. Reset links are single-use, point only at giga3ai.com, and the request response never reveals whether an account exists.
• An email address that already has a Giga3 account cannot be re-registered by someone else; it can only be claimed through the emailed reset link.
• Passwords are stored as salted scrypt hashes; we never store or log plain-text passwords.
• Sign-in, sign-up and reset endpoints are rate-limited, and repeated failures are recorded as security events for review.

2. Payments

• Checkout runs on Paystack. Card and mobile-money details are entered on Paystack, not on Giga3 AI.
• Every payment is verified server-side with Paystack before credits or plans are granted; webhook messages are checked against Paystack's signature before they are trusted.
• For automatic renewal we store only the tokenised authorisation Paystack returns, never a card number. You can delete it from your Wallet.

3. Keys and secrets

• AI provider keys, payment secrets and signing secrets live only in server configuration. They are not included in the web app bundle or exposed to the browser.
• AI provider failover happens on the server; the browser only ever talks to Giga3 AI.

4. Transport and browser protections

• All traffic uses HTTPS with HTTP Strict Transport Security.
• The site sends a Content Security Policy, frame-ancestors restrictions and other hardening headers to reduce cross-site scripting and clickjacking risk.

5. Access control

• Every request that reads or changes your data requires your session token; the server derives your identity from that token, never from values the browser sends.
• Marketplace downloads are released only after the server confirms you purchased the item or created it, and that the file passed review.
• Administrative functions require a separate admin credential.

6. Reporting a vulnerability

If you believe you have found a security issue, email [email protected] with the details and steps to reproduce. Please give us reasonable time to investigate and fix before disclosing publicly. We do not currently run a paid bug-bounty programme.