Security

#Reporting a vulnerability

Email support@adaptivebase.app with "Security" in the subject, the affected host or version, and steps to reproduce. Please give us a reasonable time to fix an issue before disclosing it, and don't access other people's data, degrade the service or run automated scanners against production. We will acknowledge your report and keep you updated.

#How Cleetus accounts are protected

• Passwords are entered only on the Cleetus sign-in page (auth.cleetus.dev), operated by Amazon Cognito. Websites and the IDE never see them.
• Clients use the authorization code flow with PKCE. Tokens are short-lived and refresh tokens can be revoked.
• The API validates every token's issuer, audience and expiry before it reaches Cleetus code.
• Stripe webhooks are verified by signature, and the service re-reads Stripe rather than trusting event contents.
• Card details go directly to Stripe and never touch Cleetus systems.
• Sites are served over HTTPS only, with HSTS, a strict Content Security Policy and no third-party scripts.

#Your code stays yours

The membership service receives only your account identity and subscription state. Your source, prompts and agent conversations are not sent to it. Engines you connect, such as Claude or Codex, process data under their providers' terms.