Security Outline

API keys are hashed at rest and scoped per project.

Stripe webhooks are verified when a webhook secret is configured and duplicate deliveries are idempotently stored.

Prometheus metrics cover ingest volume, ClickHouse writes, spool backlog, worker failures, API latency, and webhook failures.