# Security

> geolith cloud runs on Cloudflare Workers. Every request is HTTPS, keys are checked before any work is done, publishable keys only answer their allowed origins, and usage records hold counts per key and route, not the text you searched.

Last updated: 2026-10-22

## API keys

There are two kinds of key. Publishable keys (gc_pk_…) are for browsers and answer only requests whose Origin header is on the key’s allowed list; anything else gets HTTP 403 origin_not_allowed. Secret keys (gc_sk_…) are for servers and must never ship in front-end code.

Keys are stored hashed. You can create and revoke keys in the dashboard at console.geolith.app; a revoked key stops working.

## Requests and data

Usage records count requests per account, project, key, route and status, with the response time. They do not contain the text you searched or the coordinates you sent.

Cloudflare’s platform logs, kept for a short time for debugging, can include request URLs. Send keys in the Authorization header rather than the URL when you can.

## This website

geolith.app sends a strict Content-Security-Policy, HSTS, X-Content-Type-Options, a referrer policy and a permissions policy that turns off camera, microphone and geolocation. It loads no third-party trackers.

## Report a problem

If you find a vulnerability, write to contact@geolith.app with the details. Please give us time to fix it before you publish.