Security

What Screwtape stores

Judged content stays in memory for the request unless an API key sets retain to true and retention_days is not 0. A signed receipt for an API key is stored without the prompt or the output. POST /v1/receipts/verify does not store the receipt. Anonymous counts are stored only when a key opts in, and those rows have no key id and no text.

Retention

The default is 1 day, which is 24 hours. A key can choose 0, 1, 30, or 90 days for its receipts and for content it opted to retain. Existing rows keep the expiry they were given. An hourly job deletes rows whose expiry has passed. DELETE /v1/keys/me deletes the key, its receipt log, and its settings.

Encryption and signing keys

Cloudflare D1 encrypts stored data at rest. This software does not add a second encryption layer. The receipt signing key is a worker secret. It is not stored in the database. The public key is at /.well-known/screwtape-receipt-keys.json.

Subprocessors

Subprocessors are Cloudflare (the worker, D1, and hosting), Groq only when an LLM API key is set, PayPal when a pack is paid with PayPal, and the x402 facilitators https://facilitator.xpay.sh (Base) and https://x402.dexter.cash (Base and Solana). Solana settlement goes through https://x402.dexter.cash.

Report a vulnerability to screwtapedev@gmail.com. The contact file is security.txt.