Is ApilageAI safe? An honest answer
Our old PHP site was breached, so it is a fair question. Here is how the new Go platform protects students, what its limits are, and what you should still do yourself.
If you search for ApilageAI and safety, you will find reports of a data breach. Those reports are about our old PHP site, and the breach was real. You deserve a straight answer about where things stand now.
ApilageAI today is a new platform, written from scratch in Go and SvelteKit. It is much better protected than the old site. No website can promise it will never be hacked, so here is what we can say, and you can judge it for yourself.
What protects you today
- Passwords are stored only as bcrypt hashes.
- Sign-in cookies are hidden from page scripts and only sent over HTTPS.
- Changing your password signs out your existing sessions.
- Personal AI chats are tied to your account, so changing an ID in a link does not open someone else’s chat.
- Database queries are parameterized to defend against SQL injection.
- Sign-in attempts, uploads and requests are rate limited.
- You can permanently delete your account yourself at any time.
What we do not claim
- AI chats are not end-to-end encrypted. They are stored for your history and sent to AI providers to generate answers.
- Questions, replies, profiles and their images can be public.
- We have not yet published an independent security audit.
Our advice
Use ApilageAI for studying, with a password you use nowhere else. Keep passwords, ID numbers, home addresses and other sensitive details out of chats and posts. That is good advice for every AI tool, including ours.