Security

EndpointX includes a set of basic security measures to provide a safer development experience. While these protections help reduce common risks, EndpointX is not designed or audited for production use.

The platform is built for development, learning, testing, prototyping, and experimentation. It should not be used to host production APIs or process sensitive information.

Security Notice

[!WARNING] EndpointX provides a basic level of security, but we do not guarantee the security of any data stored within the platform.

Do not store anything that would cause damage if it were exposed. This applies to endpoint code, environment variables, database records, request headers, or any other data stored in EndpointX.

Safe examples:

• JWT signing secrets for testing or personal projects
• Temporary development credentials
• Non-sensitive configuration values

Never store:

• Paid API keys (e.g. OpenAI, Anthropic, Stripe, etc.)
• Production secrets or credentials
• Customer data or private information
• Any secret that has real financial or security value

If you choose to store sensitive data in EndpointX, you do so entirely at your own risk. We do not guarantee its security and cannot provide support or accept responsibility for any issues resulting from its exposure.

What EndpointX Provides

EndpointX currently implements several basic security mechanisms, including:

• Sandboxed JavaScript execution.
• Execution time limits to prevent long-running or infinite loops.
• Memory limits to reduce excessive resource consumption.
• A restricted runtime with access only to supported APIs.
• Basic request and endpoint validation.

These measures help create a safer environment for development, but they do not guarantee complete isolation or protection against all attack vectors.

Security Notice

No sandbox is perfectly secure. Although EndpointX applies multiple safeguards, every sandbox implementation has limitations and should be treated accordingly.

Not for Production

EndpointX is not a production-ready backend platform.

You should not use EndpointX for:

• Production applications.
• Public APIs handling real user traffic.
• Financial, healthcare, or other regulated workloads.
• Storing or processing confidential or sensitive data.
• Applications that require strict security, compliance, or high availability.

If your project requires production-grade security, scalability, or compliance, you should use a dedicated backend solution.

Best Practices

To use EndpointX safely, we recommend:

• Use only development or test data.
• Avoid storing production secrets in environment variables.
• Never expose sensitive credentials through your endpoints.
• Review endpoint code before sharing it with others.
• Assume that any code executed on the platform could contain bugs and design your workflows accordingly.

Our Commitment

Security is an ongoing effort. EndpointX will continue to improve its runtime, sandboxing, and security mechanisms over time.

However, users are responsible for determining whether EndpointX is appropriate for their use case. The platform should always be considered a development tool, not a replacement for a production backend.