01The short answer
ApilageAI runs on a new platform, written from scratch in Go and SvelteKit after our old PHP site was breached. It was built with that failure in mind.
No website can honestly promise it will never be hacked, and we will not make that promise. This page explains what happened, what protects your account today, what the limits are, and how to check our work.
02The breach of our old site
An attacker stole data from the database of our old PHP site. In January 2026, the security monitoring site Brinztech published an alert about a leaked ApilageAI database. It reported that the data included names, email addresses, phone numbers, student IDs, registration details, chat histories and uploaded images, for more than 1,200 students.
If you had an account on the old site, assume your details may be exposed. Our full write-up covers what this means and what to do.
03How your account is protected
Passwords are stored only as bcrypt hashes, never as readable text.
Sign-in cookies cannot be read by page scripts and are only sent over HTTPS. Access tokens are short-lived, and we store only a SHA-256 digest of the long-lived session token, so a copy of that table cannot be replayed as a login.
Changing or resetting your password signs out your existing sessions. Sign-in attempts are rate limited, and email sign-up uses a bot check.
04How your data is protected
Personal AI conversations are looked up by both the conversation and the signed-in account, so one student cannot open another student’s chat by changing an ID in a link.
Database queries are parameterized, which is the standard defence against SQL injection, the attack class that has long affected database-backed sites. API responses do not expose raw database or AI provider errors.
Uploads are checked for file type, size and image dimensions before they are stored. You can permanently delete your account and its associated records yourself.
05How the site is protected
All traffic uses HTTPS, enforced with HSTS, and passes through Cloudflare. Requests that change data must come from our own site, which blocks cross-site request forgery. Responses tell browsers not to allow framing or content-type guessing, and request sizes and rates are limited.
Secrets such as API keys are kept out of the code. Every change runs through automated tests, and our dependencies are checked for known vulnerabilities with govulncheck and npm audit.
06What we do not claim
AI chats are not end-to-end encrypted. They are stored on our servers so you can see your history, and they are sent to our AI providers to generate answers. Please do not put passwords, ID numbers or other sensitive details in a chat.
Questions, replies, profiles and their images can be public. Remove location or personal details from an image before you post it.
We have not yet published an independent security audit. We are also still adding a Content Security Policy, an extra browser defence against script injection. We will update this page when either changes.
07What you can do
Use a unique password for ApilageAI, especially if you used the old site, and change that password anywhere else you reused it. Be careful with messages that mention your ApilageAI account and ask for a password or code. We will never ask you for either.
08Report a security problem
If you find a vulnerability, email [email protected] with the subject “Security” and the steps to reproduce it. Please do not access other people’s data, and give us time to fix the problem before sharing it publicly.