API security

POST /api/generate is public and unauthenticated by design. The application code validates every request, and the hosting edge limits request volume. A deployment needs both controls.

Risks and controls

Application validation

The generation route checks the request shape, size and generator limits:

• The request needs Content-Type: application/json, or it fails with 415 unsupported_media_type.
• A body over 5,250,000 bytes fails with 413 request_too_large. The route checks the declared Content-Length first and the received body second.
• Background width and height must be integers from 64 to 4096, and their product cannot exceed 12,000,000 pixels.
• Remote URLs are not supported.
• Unknown top-level fields are rejected.
• Malformed or invalid requests return structured errors and do not change any browser project.
• The route processes submitted identity and asset data in memory and does not store it.

POST /api/brand/validate and POST /api/brand/kit apply the same media type and size rules. Read GET /api/generate and /openapi.json before sending a request. Do not relax a validator to make an outdated client work.

CORS

The agent routes send Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET, POST, OPTIONS and Access-Control-Allow-Headers: Content-Type, Accept. These headers let pages on other origins call the public contract. They do not authenticate the caller, so do not treat any request as trusted.

If a private deployment needs authentication, add it as a deliberate change to the deployment and the application, and update:

1. The OPTIONS behavior and the allowed headers.
2. The security schemes in OpenAPI.
3. The /api/agent policies and examples.
4. The browser and server clients.
5. The error handling and the documentation.

Do not add a cookie requirement to the public examples.

Production rate limit

The repository does not rate-limit requests itself. /openapi.json documents 429 for POST /api/generate as the production rate limit. The production deployment for glyphfield.com is expected to have an edge firewall rule that matches only POST /api/generate, counts requests per IP address in a fixed 60-second window, allows 10 requests, returns 429 after that and keeps the client limited for one minute.

The firewall rule is stored in the Vercel project, outside the repository. An administrator checks it with the Vercel CLI:

vercel firewall overview --project glyphfield --scope general-translation --json
vercel firewall rules list --project glyphfield --scope general-translation --json
vercel firewall diff --project glyphfield --scope general-translation --json

If the rule is missing, create it and review the diff before publishing:

vercel firewall rules add "Rate limit Glyphfield generation" \
  --description "Bound unauthenticated generation before serverless execution." \
  --condition '{"type":"path","op":"eq","value":"/api/generate"}' \
  --condition '{"type":"method","op":"eq","value":"POST"}' \
  --action rate_limit \
  --rate-limit-algo fixed_window \
  --rate-limit-keys ip \
  --rate-limit-requests 10 \
  --rate-limit-window 60 \
  --rate-limit-action rate_limit \
  --duration 1m \
  --yes \
  --project glyphfield \
  --scope general-translation

Publishing changes live infrastructure, so only an authorized administrator should do it. Afterward, confirm that the eleventh request from one client inside the window receives 429 and that requests succeed again after the window ends.

Other hosts need an equivalent limit that fits their traffic. The commands above apply only to Vercel.

Browser API boundary

The Browser API (window.glyphfield.studio) operates the active project in the visitor's browser. It reads and applies source, operates controls, accepts local files as authorized File objects and returns downloadable artifacts.

• Do not inject untrusted scripts into the Studio origin.
• Do not pass file path strings to file controls.
• Do not write to localStorage, IndexedDB or React internals directly.
• Share a returned Blob or copied source only with its authorized destination.
• Treat imported SVG, font, image, audio and Lottie files as user-supplied data.

The HTTP API has no access to this browser-local state.

Logging and privacy

Operational logs should record the route, status, duration and request kind. They should not store complete identities, embedded data URLs or generated artifact bodies. Redact authorization headers if a private deployment adds them.

A useful failure report contains:

• The request kind and the response error code.
• The dimensions and the approximate body size.
• The deployed commit or version and the route.
• Whether the failure happened during validation or during generation.

Do not paste proprietary source or binary data into a public issue.

Security checks

Before a release:

1. Confirm that valid discovery and generation requests succeed.
2. Confirm that malformed JSON returns 400.
3. Confirm that a wrong content type returns 415.
4. Confirm that an oversized body returns 413.
5. Confirm that unknown fields and remote URLs are rejected.
6. Confirm that generation responses still send no-store.
7. Confirm that the edge rate limit is active in production.
8. Confirm that no HTTP route returns browser-local projects.

Errors and limits, Endpoint reference and Self-hosting cover the error codes and deployment.