Security and trust

Built as if it held real data. It must never hold real data.

Slurry hosts synthetic test data only. We still treat every simulation as something worth protecting, and every account as something that could be abused.

Access to simulations

IP allow-list on by default: Every new simulation only answers requests from the address that created it. Add CIDR ranges for CI, or switch restriction off as a deliberate, audited choice.
Keys on every request: Simulations require a slurry_sim_ key in the Authorization or X-API-Key header. Keys are shown once, stored only as SHA-256 hashes, and can be revoked individually.
JSON only: A simulation never returns HTML or sets cookies, whatever the rules say. That stops simulations being used to host phishing pages or scripts.
Rate limits: Per-minute and monthly request limits by plan, answered with a 429 rather than silently dropped.

Accounts and keys

Two-factor authentication: Time-based one-time passwords for every account, with breached-password checks at sign-up and reset.
Scoped account keys: Management API and MCP keys carry scopes, optional IP restrictions and expiry, and are stored as hashes.
Encrypted model keys: If you bring your own model key, it is encrypted with AES-256-GCM at rest and never displayed again.
Audit log: Sign-ins, key creation and revocation, access-control changes, resets and deletions are recorded with actor, time and IP.

Outbound traffic

SSRF-safe webhooks: Webhook targets must be public. Private, loopback, link-local and metadata addresses are blocked at connect time, so a hostname that re-points after registration still cannot reach them.
Signed deliveries: Every delivery carries a Slurry-Signature header: an HMAC-SHA256 over the timestamp and body, so receivers can reject forgeries and replays.
No redirects followed: Webhook deliveries do not follow redirects and time out after ten seconds.

Abuse prevention

Payment up front: No plan activates until payment succeeds. There is no anonymous free tier to farm.
Content review: Uploaded specs, seed records, instructions and fixed response bodies are reviewed with model judgement, not keyword lists, for real personal data, phishing, malware and other breaches of the acceptable use policy.
Traffic anomaly detection: Traffic is watched for the patterns that matter here: a simulation suddenly reached from hundreds of addresses, key guessing and sustained scanning. The worst cases are suspended automatically pending review.
Spend caps: Model spend is capped per account and across the platform, so a runaway agent cannot run up an unbounded bill.

Responsible disclosure

Found a vulnerability? Email security@slurry.io with steps to reproduce. We aim to acknowledge reports within two working days and will keep you updated until the issue is fixed.

Test only against simulations in your own account, do not access other customers’ data, and do not run denial-of-service tests. Good-faith research within these limits will not be pursued.

Report abuse

If a slurry.io address is being used for phishing, spam, scraping or anything else it should not be, email abuse@slurry.io with the hostname and what you saw. We can suspend a simulation immediately while we investigate.

The rules every account agrees to are in the acceptable use policy. Personal data questions go to privacy@slurry.io.