Authentication
Email/password accounts use hashed passwords. Google and Discord OAuth can be configured through environment variables.
Built to earn trust.
Veyra is still in beta, so security claims stay specific instead of exaggerated.
Sessions
Session cookies are HTTP-only and SameSite=Lax in the current Flask application.
Preview isolation
Generated previews run inside a sandboxed iframe with script permission instead of executing directly inside the main Veyra UI.
Secrets
API keys and OAuth secrets belong in environment variables and should never be hard-coded into the front-end.
Beta reporting
If you discover a security issue, contact the Veyra team privately rather than posting exploit details publicly.
Still need help?
Ask Veyra Support without leaving the page.