Security at SevenStars

SevenStars provides a public website, desktop-client downloads, account access, character-capacity workflows, and project quotation forms. Security controls differ across the website, the desktop product, external account services, support, email, and payment boundaries.

This page describes controls supported by currently verified information. SevenStars does not claim a security certification or universal compliance status on the basis of this page.

The public website is delivered over HTTPS, which protects web traffic while it travels between a compatible browser and the website endpoint.

Connections to external account, support, email, CDN, font, and payment services have separate technical and contractual boundaries. HTTPS is not a claim that every service path is end-to-end encrypted.

Sign-in uses the existing external authentication API. After a validated login response, the website stores the authentication token and cached user information in localStorage so authenticated pages can operate. The website client does not persist the submitted password.

localStorage is readable by scripts running in the same website origin, so an injection vulnerability could expose session data. The current website does not provide verified MFA, SSO, SAML, SCIM, role-based access control, self-service password recovery, email verification, or a user-facing session-revocation control.

The quote endpoint applies request-size and field limits, server-side validation, a honeypot, an origin check when the browser sends an Origin header, rate limiting, and server-side idempotency for supported requests.

A request reference can be returned to the user. The protected idempotency state stores a digest derived from the normalized submission and delivery state rather than readable contact details or project text. Quote content is nevertheless sent to the configured customer-support and email delivery services to handle the request.

The website loads Google Fonts and an embedded customer-support widget, uses Cloudflare on the production delivery path, and communicates with external account services. Quote delivery uses customer-support and email channels. Authenticated payment records are handled through the account-service boundary.

Each external service operates under its own security, retention, availability, and privacy controls. Its contractual and certification status for this service has not been independently confirmed.

A legacy browser-compatibility protocol still relies on private-key material being supplied to compatible browser builds. A value supplied to a browser build can be recovered from that build and must not be treated as secret. Migrating the frontend and backend protocol together, then rotating the exposed key and purging obsolete artifacts, remains required security work.

Session tokens also remain in localStorage. A safer session design requires a coordinated threat model and backend-compatible migration; it is not represented as a current capability.

There is no separately verified security mailbox or public vulnerability-reward program. To report a potential security issue, use the verified support address and include “Security report” in the subject. Do not include passwords, private keys, payment credentials, or unnecessary personal data in the first message.

Send requests to support@sevenstarsai.com.