Security

• Authentication is handled by Supabase Auth: passwords are hashed, email confirmation is required, and Google sign-in uses OAuth with PKCE.
• Sessions live in HTTP-only cookies. Every server request verifies the token's signature against the provider's public keys before touching any data.
• Password reset links are single-use and expire after an hour.

• All product data lives in a dedicated database schema with row-level security enabled and no anonymous policies. Only the server, with a service key, can read or write it.
• Every query is scoped to the signed-in account. There is no shared tenant.
• Demo mode never writes to the server.

• Bring-your-own keys are encrypted with AES-256-GCM using a server-side secret before storage, and decrypted only inside the request that uses them.
• Keys are never returned to the browser; the settings page shows only that a key exists and its last four characters.
• Provider calls happen server-side, so your key is never exposed to third-party scripts.

• Wonder never submits an application, sends a message or posts on your behalf. Apply steps hand you to the employer's page and record what happened.
• Every external action is written to an audit ledger with what was done, when and under which automation policy.

If you find a security issue, use the contact form with the topic “I need help with my account” and describe what you found. We'll acknowledge within two working days and keep you informed while we fix it. Please don't access other people's data while testing.