Security posture
Movie Recap Studio is designed to separate public content from authenticated production workspaces and administrative controls. Project access is intended to be scoped to the authenticated account.
Credentials and secrets
AI provider keys, database credentials, session secrets and other sensitive configuration belong on the server or protected deployment configuration. They should never be embedded in browser bundles or committed to source control.
Authentication
Production authentication should use secure cookies, server-side session validation, password hashing and role-based authorization. Operators should deploy over HTTPS and rotate secrets before launch.
Media security
Media uploads should be validated for file type, duration and resource limits. Project-specific media access should be authenticated, and temporary or private assets should not be exposed through predictable public URLs.
Infrastructure
The public website can run separately from the heavy media-processing engine. A later VPS deployment can isolate workers, FFmpeg, transcription and Redis while retaining the same public product.
Reporting an issue
If you discover a security problem, contact the operator through the published support channel. Do not include passwords, API keys, authentication tokens or private media in the initial report.
Deployment responsibility
Security also depends on the deployment operator: operating-system updates, backups, database permissions, firewall rules, logging, dependency updates and access to hosting accounts must be maintained.