Home / Security

Security at Reelsmith

Last updated: 20 October 2026

Your provider API keys can spend real money, and your scripts and frames are unreleased work. This page explains how we protect both. Report a vulnerability to — we acknowledge within two business days and never take action against good-faith research.

API keys

• Encrypted on arrival with AES-256-GCM using a server master key that never lives in the database or source code. Each ciphertext is bound to your account and provider, so a copied row can't be decrypted for anyone else.
• Write-only: no API endpoint returns a key. You see the provider, the last four characters and when it was last used.
• Decrypted in memory only inside the render worker, only for the provider that clip uses, and sent only to that provider's own API host over TLS. Provider responses are pinned to provider hosts, so a key can't be forwarded elsewhere.
• Master keys are versioned and can be rotated; older keys are re-encrypted on next use.

Accounts and sessions

• Passwords hashed with Argon2id; known-weak passwords rejected; login timing doesn't reveal whether an email is registered.
• Optional two-factor authentication (TOTP) with replay protection; secrets are encrypted at rest.
• Short-lived access tokens (5 minutes) and rotating refresh tokens stored only as hashes. Re-use of an old refresh token signs out every session.
• Rate limits and temporary lockout on sign-in, sign-up, password reset, 2FA and every paid action.
• Sign in with Google uses OpenID Connect with PKCE, state and nonce checks.
• You can see and revoke every signed-in device, and review your security activity log.

Application hardening

• Cookies are HttpOnly, Secure and SameSite=Strict; every state-changing request needs a CSRF token and a same-origin check.
• Strict Content-Security-Policy (no inline or third-party scripts), clickjacking protection, HSTS, no-sniff and a locked-down Permissions-Policy.
• Every database query is parameterized and scoped to the signed-in account; request bodies are validated against explicit schemas.
• Uploaded images are decoded and re-encoded server-side — format checked by content, location metadata stripped, oversized images rejected. Files are stored outside the web root and served only to their owner.
• Outbound downloads accept HTTPS only and refuse private and internal network addresses.

Your data

• Export everything we hold about you as JSON, or delete your account, films and files in one step from Settings.
• We never use your scripts, images or renders to train models. Providers you send prompts to are governed by their own terms.
• Finished films carry an "AI-generated" metadata tag to support platform disclosure rules.

See also: Terms · Privacy · Cookies · Acceptable Use · Subprocessors · Security