SECURITY
Operational security by default.
AXION separates public application behavior from server-side secrets and uses HTTPS for the public site. Payment sessions and AI-provider credentials are handled server-side rather than embedded as reusable secrets in public page markup.
Current safeguards
- HTTPS transport with HSTS at the edge.
- Security response headers for framing, MIME sniffing, referrer behavior and sensitive browser permissions.
- Server-side Stripe Checkout Session creation.
- True HTTP 404 responses for missing canonical resources.
- Build validation before production restarts.
- Backups and rollback points before infrastructure changes.
Responsible disclosure
If you believe you found a security issue, use the contact page and include the affected URL, reproducible steps and impact. Do not include private credentials in public reports.
This page describes implemented operational controls and does not claim an external certification or audit that has not been independently completed.