Revocable credentials
Personal API keys are shown once and stored as one-way hashes. OAuth connections and API keys can be revoked without changing an account password.
Security
How we protect
your access.
Connections are encrypted, credentials can be revoked and persistent project data is isolated to its owning account.
Encrypted connection
The MCP endpoint uses HTTPS. Authenticated requests are rate-limited and unrecognised browser origins are rejected.
Bounded access
Tools can create and update design projects inside the authenticated CodeCrafted account. They cannot browse a client device, run repository code or fetch a submitted reference URL.
Data minimisation
Operational measurement records event type, outcome, coarse duration and pseudonymous account identifiers. Design inputs and response bodies are excluded from telemetry.
Security reporting
Report a security issue.
Please do not test against other accounts or publish sensitive details. Email the issue, its impact and the steps needed to reproduce it to security@codecrafted.co.uk.