Security

Baise developer keys are HMAC-hashed with a server-only pepper, displayed once, explicitly product-scoped, rate-limited, audited, and revocable.

Report suspected credential exposure immediately and revoke the affected key from the developer console. Do not send secrets through email, chat, screenshots, support tickets, or URLs.

Production disclosure and incident-response contacts must be inserted before launch.

Security disclosure draft · 24 August 2026