Platform

Security

Auth, the API and AI chat are guarded by one protect() call. With an Arcjet key it runs shield, bot detection and rate limits. Without one, the same limits run on a Postgres counter that's correct across instances.

• Arcjet

What you get

• Fixed-window limits per route, set in config
• Limits keyed by IP and path for auth, by IP for the API, by user for AI
• 429 responses with retry-after
• Audit logging with passwords, tokens and codes redacted

Turn it on

• appConfig.arcjet in config.ts
• ARCJET_KEY, optional

Where it lives

• lib/protect.ts
• lib/rate-limit.ts
• lib/arcjet.ts
• lib/audit.ts