TLS everywhere, least-privilege access, and encrypted tokens for auth flows.

Audit logs, rate limiting, IP-aware risk checks, and monitored Stripe webhooks.

On some authenticated routes, AiTracker may enable a client-side deterrence overlay to reduce casual tampering. The overlay can trigger when leaving the window, when DevTools is detected (best-effort), or when blocked shortcuts (e.g., F12) are used. This does not replace server-side security. Billing, checkout, auth, and legal pages are excluded by default. Admins are soft-locked only and can temporarily bypass for support/debugging.