Legal

Security

TLS at the edge, secrets on the server, minimal client surface.

Last updated: 23 August 2026

Transport

HTTPS / TLS — production traffic terminates on the CDN edge (Cloudflare Pages). HSTS is set via _headers.
Same transmission pattern companies use for public static sites: TLS to the edge, cached assets, optional Worker for API paths.

Secrets

No production API keys in client code. xAI keys for TTS belong in Worker secrets (XAI_API_KEY) or a local box proxy — never committed to the repo, never shipped in js/.
Browser localStorage keys are for local preview only and should be rotated if exposed.

Browser hardening

Cloudflare Pages _headers ships a Content-Security-Policy appropriate for this static book plus optional same-origin /api/tts, plus X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. See the site root _headers file.

TTS proxy

The Workers stub under workers/tts-proxy/ forwards POST /api/tts to api.x.ai/v1/tts with a server-side secret, CORS locked to the Pages origin placeholder, and README notes on rate limits. Clients should call same-origin /api/tts only.

Report a vulnerability

Please email security@malachai.com (placeholder — replace with a monitored inbox). Include steps to reproduce, affected URL, and impact. Do not include live secrets in the report body if avoidable; share out-of-band if needed.

We aim to acknowledge good-faith reports within a reasonable time. This is not a paid bug bounty unless separately published.

Privacy · Terms · Cookies · AI disclosure