Security
Last updated: 31 October 2026
How the API and MCP server protect you (launching soon)
- Keys are hashed. API keys are stored only as SHA-256 hashes, and our account database holds account emails only as one-way hashes. Ordinary logs never contain a plaintext key. Rotating a key revokes the old one at once.
- Keys stay out of URLs. Keys go in the X-API-KEY or Authorization: Bearer header, never in a URL.
- Read-only by default. The MCP server lists read tools plus feedback only. Account and purchase tools are off: they are not listed and cannot be called.
- Rate limits. Every request is limited per IP prefix, and key-bearing requests per account too. Repeated failed authentications move a prefix to a separate, stricter limit.
- Untrusted data stays data. Listing text is returned as structured fields, labelled for agents as untrusted data, and never used in tool descriptions.
- Refused, not unchecked. If a safety check cannot run, the request is refused.
How this site protects you
- HTTPS only, with HSTS.
- A strict Content Security Policy: no scripts run on this site, and no page can be framed.
- No third-party scripts, fonts, analytics, trackers or cookies.
Who handles data for us
Cloudflare (hosting, DNS, email forwarding and the waitlist), and Stripe (payments, once paid plans open). See the privacy policy.
Reporting a vulnerability
Email info@boogiedata.com with the details and how to reproduce them. Please don't access other people's data, degrade the service or publish the issue before we have fixed it. Our security.txt has the same contact.