Security
Security boundaries designed around the creator.
TrueCut separates public discovery from authenticated work and applies ownership checks at the routes that handle accounts, assets, jobs, connected clients, and mutations.
Scoped account access
Private data is resolved from the authenticated browser session or OAuth token. Tool calls do not get to choose a trusted user identifier.
OAuth for connected clients
MCP and CLI connections use OAuth authorization flows with explicit scopes. Stored access and refresh credentials are hashed rather than retained as reusable plaintext secrets.
Protected mutations
Generation, asset, workflow, and account mutations are rechecked at their route handlers even when an optimistic navigation gate has already run.
Responsible disclosure
Report suspected vulnerabilities privately through the contact page. Include reproduction steps, affected route, impact, and a safe way to coordinate—without accessing data that is not yours.