TLS / HTTPS
Agent API URLs use HTTPS:
Use the exact host supplied by the operator. The public documentation does not yet define a minimum TLS version, certificate policy, mutual-TLS option, proxy topology, or IP-allowlisting contract covering all Neuron deployments. Obtain those controls from the deployment owner before production.
Credential management
- Store account passwords, account-creation API keys and secrets, and JWTs in a secrets manager or protected runtime configuration—never hardcode them.
- Never log full JWT tokens or HMAC secrets in your application logs.
- If a credential may be compromised, stop using it and follow the rotation or account-recovery procedure supplied by the Neuron operator. A universal rotation API is not currently documented.
Keep trusted credentials out of public clients
- Never embed an account-creation API secret or trusted account password in browser or mobile code.
- Put trusted Agent API calls behind an application backend.
- Return only fields the user-facing client needs.
- Keep JWTs out of URLs, analytics, crash reports, and browser-visible errors.
- Verify cookies, CORS, redirect origins, and CSRF protection for the exact browser flow and deployment.
Storage and logging
The documentation does not establish one encryption-at-rest algorithm or automatic masking policy for every Neuron deployment. Classify the data your application stores, minimize it, encrypt it according to the deployment’s approved policy, and redact logs at the application boundary.
Never log account passwords, API secrets, full JWTs, authorization headers, private keys, or unreviewed identity and contract payloads.
