Security
Security is a first-class concern, not an afterthought
An overview of how PrimeWebKit protects your account, your chatbots, and your customers' data.
Authentication
Short-lived JWT access tokens with opaque, server-revocable refresh tokens stored hashed in the database. Account lockout after repeated failed logins.
SQL injection
Every query runs through a parameterized query builder or prepared statements — user input is never concatenated into SQL.
SSRF protection
Website crawling and outgoing webhook URLs are validated against private, loopback, link-local, and cloud-metadata address ranges — re-checked at every redirect hop, not just the initial request.
Rate limiting
General API throttling plus a stricter, cost-aware limit on AI-generating endpoints to prevent abuse of the underlying model provider.
Prompt-injection defense
Retrieved knowledge-base content is screened for injection patterns before being placed in a prompt; direct attempts in visitor messages are flagged.
CORS & CSRF
Explicit origin allow-listing with credentialed responses only for exact matches, never a wildcard. Authentication is a Bearer token, never an ambient cookie, so cross-site request forgery doesn't apply.
Found a vulnerability?
Email security@primewebkit.com with reproduction steps and the affected endpoint. We investigate every report.