Secure website sessions
NextAuth uses JWT sessions with the configured secret and account middleware protects `/account/*` routes.
Security
Account security
UGP keeps public pages, account sessions, linked devices, API keys, payments, and local code work separated by clear permissions.
Google sign-in
Google sign-in is hidden or marked unconfigured unless a usable client id and secret are present.
Email and password
Email login and registration call the configured authentication server. The website does not invent local-only users.
Device linking
Desktop device routes remain separate from public site routing and are used for scoped linked-device sessions.
API key lifecycle
Keys are scoped, rate limited, rotated or revoked through account actions, and secrets are revealed once.
Payments and account audit
Payment portal, invoices, spend exports, history deletion, and team changes are account actions with real server state.
Security model in plain language
Public pages
Marketing, docs, pricing, download, legal, and status pages should stay readable without an account and must not expose private account state.
Protected account area
Projects, history, devices, API keys, teams, billing, usage, and settings require a signed-in session and should redirect guests to login.
Local project access
Local repositories and terminal work belong to the Windows app. The website should not request broad local file access or pretend it can inspect files in the browser.
Administrative changes
Key rotation, device revocation, member changes, billing portal access, and destructive history actions should remain explicit account actions.
Before using UGP with real projects
- Confirm the site URL and API endpoint are the production values you expect.
- Use verified sign-in routes and avoid sharing account credentials between people.
- Create API keys with the smallest practical scope and rotate them after exposure.
- Remove stale devices and team members before connecting production work.
- Review AI-generated changes before applying, committing, or deploying code.