Platform and payment security

See the guards on the public surfaces: payments, rate limits, browser headers and assistant connections.

Updated 23 September 2026

On this page

Why: Every public door is a place to be scanned, flooded or framed.
How: Each guard applies on every route, not only the pages that feel sensitive.

Payments

Card details go straight to Stripe. Kabaido stores only Stripe's references, the plan, the billing period and the renewal date, and accepts payment events only with a valid Stripe signature.

Rate limits

The REST API, the AI routes, inbound endpoints, the quote portal, access code redemption and the OAuth endpoints are rate limited. The limiter is a token bucket held in the database, so it holds across every server, lets a legitimate burst through and stops a sustained flood with a clear error. Limits per surface are on Rate limits.

Browser headers

Header	What it does
Strict-Transport-Security	Two years, subdomains included, preload requested: no plain HTTP.
X-Frame-Options and frame-ancestors	Framing denied everywhere except the wizard embed, which is protected by its key and a domains allowlist.
X-Content-Type-Options	No MIME sniffing, so an upload cannot run as something else.
Referrer-Policy	Strict origin when cross origin, so a token link never leaks to another site.
Permissions-Policy	Camera, microphone and geolocation are locked down on every route.
Content-Security-Policy	Report only while violations are observed on real traffic, with every allowed origin named.

AI assistant connections

MCP connections are approved by you over OAuth with PKCE, carry scopes capped by your own role and can be revoked from Settings. Access tokens are short lived; a call outside the granted scopes returns an error, not data.

Reporting a vulnerability

Email hello@kabaido.com with the details and a person reads it. Please never test against another organisation's data.

PreviousCompliance and GDPR NextData export and deletion