Verified account linking
Implicit linking requires a verified local identity and matching provider email; different-email linking remains disabled.
A self-contained security model with visible boundaries
Identity, workspace access, channel secrets, media storage, and execution stay inside the deployment you configure.
Better Auth owns the complete session lifecycle
Social login, email OTP, anonymous upgrades, account linking, and secure cookie sessions share one persisted auth model.
Hashed email codes
Email OTP values are stored hashed, expire after ten minutes, and enforce a limited number of attempts.
Protected application routes
TanStack Start resolves the server session before protected dashboard routes and handlers proceed.
Keep provider credentials out of the browser
Sensitive channel tokens are handled on the server and encrypted before they reach the configured database.
Encrypted provider tokens
A dedicated encryption key protects stored access and refresh tokens; missing keys fail configuration checks.
Private storage choices
Use R2, S3, or local storage and expose media through application-controlled routes or an explicit public media origin.
Database ownership
Run Postgres, SQLite, or D1 in your own environment instead of sending application state to a separate CMS backend.
Security claims stop where evidence stops
BlendDuck does not claim SOC 2 certification, a public uptime SLA, or third-party compliance audits that have not been completed.
Explicit environment validation
Production origins, secrets, storage, job backends, and provider credentials are validated where they become required.
Organization authorization
Repository access checks membership and role before organization-bound MCP and application operations proceed.
Visible provider failures
Authentication, permission, validation, and provider failures are returned as real errors instead of silent success states.
Own the database, secrets, and execution environment
Choose the runtime that fits your controls, configure the required secrets, and connect only the providers you are ready to operate.