Security

AethexFlow keeps user working content on the browser/device. Cloudflare D1 is restricted to account credential hashes, billing/webhook metadata and verified generic reusable workflow templates. Current commands are processed transiently for routing; the workflow table does not store the original command.

Sessions

Sessions are stateless HMAC-signed cookies with HttpOnly, Secure and SameSite=Strict. Passwords and recovery codes are stored only as salted PBKDF2-SHA256 hashes.

Billing webhooks

Lemon Squeezy requests require a strict 64-character hexadecimal X-Signature. HMAC-SHA256 is checked over the raw request body before JSON parsing. Idempotency uses a 5-minute processing lease and subscription updates reject older source_updated_at state.

Private panels

Owner and Team panels use separate Cloudflare secrets and are served with no-index/no-store headers.