Security boundaries, not magic words.

Idea Builder uses technical controls to separate customers and consequential actions. It does not claim that prompts are cryptographic secrets or that any internet service is risk-free.

• OAuth 2.1 with PKCE and verified upstream identity claims.
• One immutable user mapped to one isolated workspace; authorization is applied server-side.
• Revision-safe writes, human-only Candidate approval, explicit action authority, and audited mutations.
• Server-authoritative Free/Early Access policy at API, MCP, and storage boundaries.
• Server-validated Turnstile for new public enrollment when enabled.
• Stripe signature verification from the unchanged body, replay tolerance, unique event storage, deterministic ordering, and test/live separation.
• No customer-supplied API-key collection or provider-credential storage.
• Dependency vulnerability audit required before every deployment.

Ongoing verification

Tenant isolation, backup and restore, production secrets, abuse controls, incident response, monitoring, and dependency integrity are continuously verified release controls.