Authentication
Email/password accounts use hashed passwords. Google and Discord OAuth can be configured through environment variables.
TRUST & SECURITY
Built to earn trust.
Veyra is still in beta, so security claims stay specific instead of exaggerated.
Sessions
Session cookies are HTTP-only and SameSite=Lax in the current Flask application.
Preview isolation
Generated previews run inside a sandboxed iframe with script permission instead of executing directly inside the main Veyra UI.
Secrets
API keys and OAuth secrets belong in environment variables and should never be hard-coded into the front-end.
Beta reporting
If you discover a security issue, contact the Veyra team privately rather than posting exploit details publicly.
Need help with Veyra?
Open Support without leaving the site.