Security and data

Last reviewed: 20 October 2026

Mastermind separates work data by user or tenant. Agent actions that write data require deliberate approval and are logged. Content from email, notes, websites, uploads, and shared documents is treated as untrusted model input; instructions contained in such content must not trigger tools or actions.

The public demo contains fictional data only and is reset every 30 minutes. Sessions, tokens, uploads, and demo records are removed only for the fixed demo account. AI, email, payment, and external CRM calls are blocked server-side. Do not enter real, confidential, or personal data into the demo.

Registration and login are rate-limited. Forms use CSRF protection, and uploads have type, size, and frequency limits. Session cookies are HttpOnly, SameSite=Lax, and Secure over HTTPS. Responses use CSP, HSTS, clickjacking, and MIME protections.

Known open work includes complete self-service account deletion, rotation of the existing session secret to at least 32 random bytes, and a provider-wide daily cap in addition to per-user AI budgets. The production port moves to loopback when the reviewed deployment commit is released. An already running request cannot be cancelled atomically by the demo reset; the account is disabled during reset and its sessions are revoked.

Report security issues to hello@loeser.solutions. Do not include secrets or personal data in the initial message.