Log inGet API key
Security and responsible disclosure

Protect your key. Report issues safely.

Model.sale is a prepaid API gateway. We design the public surface to expose model, pricing and reliability facts without exposing customer content, provider credentials or internal routes.

CredentialsAPI secrets are shown once, stored as keyed digests and never accepted in URLs, analytics or support tickets. Revoke an exposed key immediately.
Data minimizationPrompts, source code and responses are not written to logs, traces, analytics or Sentry by default. Playground history is opt-in and encrypted.
Layered controlsSessions, rate limits, spend caps, Turnstile, audit logs and transactional billing controls protect accounts and the wallet.

Responsible disclosure

Send a report to security@model.sale. Include the affected URL or endpoint, impact, minimal reproduction steps and a suggested mitigation. Redact all credentials and customer data. Do not test against another user, payment callback, production model route or denial-of-service scenario.

We acknowledge actionable reports, investigate within a reasonable time and coordinate a fix or mitigation. Automated scanner output without an exploitable reproduction may be treated as informational.

Account safety checklist

  1. Use one API key per application and the narrowest model, IP and spend limits.
  2. Keep ms_live_* in a server-side secret manager or protected environment file.
  3. Rotate keys after a screenshot, log leak, employee change or unexpected usage.
  4. Enable MFA on the account used for administration and keep recovery access offline.
  5. Contact support for billing disputes, and security for suspected credential exposure.