Security

AIMS takes security seriously. Here is how we protect your data, keys, and assets.

API Key Storage

API keys are hashed with SHA-256 before storage. The raw key is shown only once at creation time and cannot be retrieved afterward.

JWT Authentication

Session tokens are HMAC-SHA256 JWTs with short expiration. All authenticated endpoints verify the token on every request.

Admin Key Isolation

Administrative operations require a separate admin key verified via constant-time comparison. Admin and user auth paths are fully separated.

Relay Key Authentication

Relay API keys use the aims_sk_ prefix with dedicated rate limiting, quota tracking, and per-key tier enforcement.

On-Chain Blacklist

Suspended wallets are blocked at the middleware layer via both a local identity check and an on-chain blacklist query.

SSRF Protection

The relay service validates all target URLs against internal/private network ranges before proxying requests.

Input Sanitization

All user-provided content is sanitized: null bytes, control characters, and surrogate pairs are stripped. Payload lengths are enforced.

Production Secret Validation

The backend refuses to boot in production if critical secrets (JWT secret, encryption key, admin key, database URL) are missing or set to insecure defaults.

To report a security vulnerability, please contact us through Discord or the Forum. Do not disclose security issues publicly until they have been addressed.