Security

• API keys stored as SHA-256 hashes; plaintext shown once at install
• Webhook signature verification when Stripe secrets are configured
• Event payloads allowlisted — untrusted fields are dropped
• Packet generator is deterministic and source-bound (no invented claims)
• Kill switches disable auto-submit on elevated error / missing-evidence ratios
• Demo mode uses local encrypted-at-rest file store for development only