Security

Identity and sessions

• ·Log in uses Amazon Cognito (first-party email/password or OAuth with PKCE). StoriesForge does not store passwords; Cognito verifies them and the app keeps only a signed session cookie.
• ·The session cookie is HTTP-only, same-site, secure in production, and signed; it carries an account id and an expiry, not your data.
• ·Mutating requests are checked for same-origin provenance, so a form on another site cannot act as you.

Authorization

Knowing a world, chapter, or image id grants nothing. Every read and write resolves your account, resolves the reader bound to it, and re-checks membership of the world in question. Owner-only actions — deleting a world, inviting a reader — check ownership separately from membership.

Administration is a role on the account, held by an explicit allowlist, and is required for every admin route rather than only for the admin pages.

Data protection

• ·In transit: TLS everywhere, with the application refusing to boot in cloud mode without the configuration that requires it.
• ·At rest: managed database encryption and server-side encryption for illustration objects.
• ·Isolation: one database, one row-level owner per world, and queries scoped by owner or membership rather than by request parameter.
• ·Backups: automated, retained, and exercised by a documented restore runbook rather than assumed to work.

Model and image providers

Providers are chosen by the deployment, not by the customer, so a reader cannot point the engine at an endpoint of their own. Only the context a step needs is sent, and provider credentials stay server-side; nothing that talks to a provider runs in your browser.

Durability of generation

A turn is recorded as a durable command before any model is called, and its prose, the model's raw response, and the validator's report are stored as append-only evidence. A crash mid-generation therefore leaves a recoverable, inspectable state rather than a silently lost chapter or a double charge.

Credit reservations are released when work fails and committed when it publishes, in the same transaction as the work itself.

Payments

Card data never reaches StoriesForge. Paddle is the merchant of record; webhooks are signature-verified and processed exactly once against an event ledger, so a replayed notification cannot grant credits twice.

Reporting a problem

If you find a vulnerability, tell us before telling anyone else and give us a reasonable window to fix it. We will not pursue good-faith research that avoids other people's data, avoids degrading the service, and stops at the first finding.

Operator and contact

Carlos Mahonri Monterroso Garcia

ALDEA EL CARMEN, 3 AVENIDA, Cdad. de Guatemala 01051, Guatemala

cmonterrosog@proton.me