willchen96 pulls sensitive data off the client and bolts the doors shut
A broad security sync moves profile handling to the server and hardens the API against the easy forms of abuse.
This is a hardening pass rather than a new feature, but it closes several openings at once. The through-line: stop trusting the browser with things the server should own.
- User profile data now reads and writes through the backend instead of directly from the public client, so profile records are no longer exposed to the front end.
- The server now decides whether a given user has a working model key, rather than leaving that logic in the browser.
- Rate limiting caps how hard the service can be hit, giving baseline protection against abuse.
- A standard set of security headers guards against the common class of browser-side attacks.
- Chat creation and streaming now check that a user actually has access to a project before a chat is tied to it, closing a gap where an unvalidated project could be attached.
So what Anyone weighing this build for client work should note it now handles sensitive data and access checks server-side, where they belong.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?