Security and privacy are important to Refract. We aim to protect user accounts, uploaded research papers, reading history, and other user data.

Refract is an early-stage product, and this policy will evolve as the platform grows.

If you discover a security vulnerability in Refract, please report it privately rather than publicly disclosing it.

When reporting a vulnerability, please include:

• A description of the issue
• Steps to reproduce it
• Potential impact
• Relevant screenshots or proof of concept, if applicable

Please do not include passwords, API keys, personal information, or other sensitive information in vulnerability reports.

Refract uses OAuth-based authentication for user accounts.

Authentication credentials, OAuth secrets, API keys, and other sensitive credentials must never be exposed to the client or committed to the repository.

Users must only be able to access their own private data.

This includes:

• Uploaded research papers
• Reading history
• Reading progress
• Saved papers
• AI conversations and queries associated with their account

Authenticated requests must verify both the user's identity and ownership of private resources.

All sensitive API keys and secrets must be stored as server-side environment variables.

Never:

• Commit secrets to Git
• Expose API keys in frontend code
• Return secrets through API responses
• Log API keys
• Log sensitive user data unnecessarily

API endpoints should validate input and reject unauthorized requests.

Uploaded research papers should always be treated as untrusted input.

Refract should:

• Validate file types
• Enforce reasonable file-size limits
• Store uploaded files securely
• Prevent unauthorized access to uploaded files
• Never execute uploaded files
• Validate files before processing them

AI requests should only receive the minimum amount of user and paper context required to answer a request.

User-specific research data must never be included in another user's AI request.

AI-generated responses should be grounded in the research context provided to the model.

Environment files containing secrets must not be committed to the repository.

Example:

.env
.env.local