CakeCut security

Session and API credentials are checked on the server. Secret tokens are not returned in normal API responses, logs, analytics events, or public pages.

Device-local media remains in app or browser storage. Cloud processing transfers the material needed by that feature. Server jobs record progress and cleanup state; a completed processing job is not, by itself, proof that every provider or backup copy has been deleted. See /privacy for the data and retention boundaries.

CakeCut records durable state for server-side jobs and checks important recovery paths. Security reports should include the affected route, time, and a concise reproduction without customer media or credentials.

Send a security report to [email protected]. Do not include passwords, API keys, private caption text, or raw customer media in the first message.