Privacy & Platform Security
Discover the security protocols protecting your data: HSTS Preload, Strict CSP, and Role-Gated Admin Controls.
Lexino AI is architected with a security-first stance to ensure student and user data remains private and protected.
#Security Headers & Hardening
• Strict-Transport-Security (HSTS): max-age=63072000; includeSubDomains; preload enforces end-to-end HTTPS across all subdomains.
• Content-Security-Policy (CSP): Zero unsafe-eval in production. Explicit trusted allowlists for Clerk and Razorpay.
• Process Isolation: Cross-Origin-Opener-Policy (same-origin-allow-popups) and Cross-Origin-Resource-Policy (same-site) protect against Spectre and cross-origin data leaks.
• X-Frame-Options: SAMEORIGIN defends against clickjacking and UI redress attacks.
#Role-Gated Admin Console
The internal operations console (/console/*) is gated behind strict server-side Clerk role verification. Unauthenticated or non-owner requests receive a strict HTTP 404 (Not Found) with noindex headers, completely concealing internal consoles from search crawlers and unauthorized visitors.