Technical Security | Arc en Ciel

Browser and Transport Security

• Production traffic is served over HTTPS.
• The production NGINX layer sends HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy headers.
• The API also uses Helmet for baseline HTTP security headers.

Account Protection

• Accounts support email verification and password reset flows.
• Users can enable authenticator-app two-factor authentication with recovery codes.
• Authentication, two-factor, reset, register, and API key flows are rate limited.

Abuse Prevention

• Registration can be protected with Cloudflare Turnstile.
• Public, authenticated, write-heavy, and media routes use separate rate-limit profiles.
• Moderation, DSA notices, illegal-content reports, audit logs, and admin tools are handled through restricted workflows.

Independently Checkable Signals

• Browser security headers can be checked live with an HTTP client or external header scanner.
• The security.txt file is a machine-readable vulnerability disclosure contact at /.well-known/security.txt.
• Stripe Checkout and the Stripe Billing Portal can be verified during the supporter payment and cancellation flow; Arc en Ciel does not ask for card numbers directly.
• Public integration repositories are inspectable on GitHub, including the current Link Key flow for local worker connections.
• The model-safety production snapshot is generated from the production Version table at request time and exposes live format, hash, source, and scan-status counts.
• Arc en Ciel does not claim a third-party security audit yet; this page separates externally checkable signals from operator self-statements.

• Security.txt Machine-readable security contact and policy.
• Model safety snapshot Live production inventory summary for model-file safety reviewers.
• Arc en Ciel Link for ComfyUI Public integration repository for local ComfyUI download workflows.

Payments

• Optional supporter memberships and one-time donations use Stripe Checkout and Stripe Billing Portal flows.
• Supporter payments are not investments, securities, profit-sharing products, or guaranteed-return products.
• Arc en Ciel does not accept cryptocurrency payments or direct bank transfers for supporter checkout.
• Stripe webhook signatures are verified server-side.
• Arc en Ciel does not store full payment card numbers on its own systems.
• Billing, checkout, cancellation, and withdrawal support is available via [email protected].

• Billing policy Supporter membership, donation, Stripe checkout, cancellation, and refund guidance.
• Terms of Service Platform terms, supporter payments, acceptable use, and legal contact context.
• Withdrawal policy Plain-language guidance for statutory withdrawal requests and immediate digital access.
• Support page Product entry point for supporter checkout and the billing portal when signed in.
• Stripe Third-party payment processor used for supporter checkout and recurring billing.

Model and Download Safety

• 100% of model-weight files currently eligible for normal delivery use structurally validated non-pickle formats and carry CLEAN local verification evidence.
• Safetensors remains the preferred generative-weight format; self-contained ONNX is used for compatible segmentation models because both avoid pickle execution during normal loading.
• Local model files are hashed with SHA-256; safetensors containers and ONNX graphs receive format-specific structural validation before delivery.
• Pickle-capable model uploads receive additional server-side checks but remain blocked for isolated review instead of being treated as safe tensor containers.
• Only files with CLEAN local verification evidence are eligible for normal download delivery; every other scan state fails closed.
• External URL references that Arc en Ciel does not host locally are surfaced with an explicit UNVERIFIED_EXTERNAL status and remain blocked until a local copy passes verification.
• A dedicated model-safety page exposes the policy and a crawlable production inventory snapshot.

• Model safety snapshot Current model-file safety policy and inventory summary.

Link Keys and Local Integrations

• Arc en Ciel Link uses scoped, revocable Link Keys (`lk_...`) for current local worker connections.
• General account API keys are legacy for Arc en Ciel Link and are not accepted for the current Link WebSocket worker flow.
• Link keys are stored hashed server-side, and local bridge integrations should stay loopback-scoped unless a user explicitly configures trusted local-network testing.