Amanai applies practical safeguards appropriate to the service, while recognizing that no system or upstream path is risk-free.
Our approach
Security is a shared, evolving process. We design the gateway to minimize inference-content persistence, restrict administrative access, isolate secrets from public clients, and reduce abuse while preserving useful API compatibility.
Current controls
We use layered safeguards for authentication, session handling, access control, traffic management, bot protection, payment reconciliation, abuse detection, operational auditing, and client-facing error handling. Prompt and response bodies are not persisted in the Amanai gateway database. Controls are reviewed and may change as the platform and threat conditions evolve.
Your responsibility
Keep API keys and OAuth sessions confidential, rotate or revoke credentials after suspected exposure, restrict server logs, validate webhook and payment details, and do not embed secret keys in public client applications. You are responsible for securing systems that call Amanai and for reviewing generated code or commands before execution.
Limits and no absolute guarantee
No network, database, credential system, blockchain workflow, or third-party provider is completely secure. Amanai depends on infrastructure and upstream processors outside its direct control. We do not claim end-to-end encryption, zero retention across all upstreams, immunity from breach, or compliance certification that has not been expressly documented.
Responsible disclosure
Send vulnerability reports to security@amanai.dev. Include affected URL or component, reproducible steps, impact, and a safe proof of concept. Do not include unrelated personal data or live secrets.
Good-faith research must avoid accessing other users' data, persistence, social engineering, destructive testing, denial of service, high-volume scanning, public disclosure before remediation, or exploitation beyond what is necessary to demonstrate the issue. We do not currently promise a bounty, response deadline, or safe-harbor agreement unless confirmed separately in writing.