Security at Lucenos
How we protect sign-in, API keys and your account data.
Encrypted connections
Lucenos is served over HTTPS only. Our server sends an HSTS header, so browsers keep using HTTPS on later visits.
Passwords and sign-in
Sign-in is handled by Clerk. Your password goes to Clerk and is never stored in the Lucenos database. New sign-ins from an unfamiliar device ask for a code sent to your email.
Sessions
When you log out, the server revokes your session, so it stops working even if the browser tab is closed right away.
API keys
We store only a SHA-256 hash of your API key and its first few characters for display. The full key is shown once, when you create or rotate it. If you lose it, rotate it to get a new one.
Your data
Account data lives in a database on our own server, which is not open to the internet. Reads and writes of links, orders and payouts are scoped to the signed-in account, and link creation is rate limited per account.
Report a problem
If you find a security issue, email apply@lucenos.io with the details. Please give us time to fix it before sharing it publicly.