Security at Demogent

Security shapes our architectural decisions, not something bolted on afterward. We handle your account data, source material, and authentication tokens, and we hold ourselves to a high standard for that. This page documents our current security posture.

Authentication is handled entirely by Kinde. We do not store passwords.

• OAuth sign-in via Google and GitHub, or email, with no password storage on our end.
• Session tokens are short-lived, HttpOnly cookies, inaccessible to JavaScript running on the page.
• CSRF protection on state-changing endpoints.
• Every authenticated route verifies the session server-side before processing a request. Dashboard routes are gated both by proxy-level middleware and a server check in the layout.

Demogent runs on infrastructure from providers with strong security track records.

• Database queries go through Prisma ORM with parameterised statements, not raw string concatenation.
• Access to project data is scoped to the account that owns it and checked server-side on every request.
• User-submitted content is never executed server-side.

We run a responsible disclosure programme. If you find a security vulnerability in Demogent, we want to hear from you.

Please do not

• Perform automated scanning against production systems.
• Access or modify other users' data.
• Disclose vulnerabilities publicly before we've had a chance to address them.

Last reviewed: August 14, 2026, Demogent