Built on a security-first foundation
The Mind Security Engine adds security headers, local suspicious-request detection, upload validation, human verification for suspicious traffic, API throttling, and optional Arcjet protection. Supabase row-level security keeps signed-in users scoped to their own studios, files, chat history, and settings.
Security layers
What the Mind Security Engine protects
ScholarMind applies multiple overlapping layers of protection so you can focus on studying without worrying about data safety, abuse, or unexpected costs.
End-to-end encryption headers
Strict security headers (CSP, HSTS, X-Frame-Options) are applied to every response to prevent common web attacks.
Suspicious-request detection
Local pattern-matching flags unusual request behaviour before it reaches your study data.
Upload validation
Each uploaded file is checked for type, size, and content safety before it is stored or processed.
Human verification
Suspicious traffic triggers a lightweight human check — keeping bots out without a noisy CAPTCHA.
API throttling
Rate limits and hourly/daily AI usage caps prevent runaway costs and abuse of the study tools.
Arcjet optional protection
Arcjet can be enabled for deeper threat intelligence — bot detection, VPN blocking, and IP reputation.
Supabase RLS at rest
Row-level security in Supabase keeps signed-in users scoped to their own studios, files, chat history, and settings.
How it works
Request lifecycle through the engine
Request arrives
Every API request hits the Mind Security middleware before reaching your study data.
Headers are set
Security headers are injected into the response, locking down what browsers and scripts are allowed to do.
Behaviour is scored
The engine scores the request against known abuse patterns — unusual rate, unexpected payloads, bot signatures.
Decision is made
Clean requests pass through. Suspicious requests get a human challenge. Malicious requests are blocked entirely.
Transparency
What we monitor and what stays private
What is monitored
- Request patterns — rate, origin, and behaviour scoring
- Feature usage — aggregate trends for reliability
- Upload validation — file safety before processing
What stays private
- Your study sources, AI outputs, and chat history
- Studio content is never exposed publicly
- Personal data is accessible only via Supabase RLS