AI workflows execute code, make API calls, and process sensitive credentials. Security is not a feature we added later — it is the structural foundation the platform was built on. Every layer is designed so that a compromise at one level cannot cascade into a broader failure.
Every file in every uploaded ZIP archive is processed through a ClamAV anti-malware pipeline before it reaches the marketplace. We scan for known malware signatures, obfuscated payloads, reverse shells, and suspicious execution patterns. A single flagged file quarantines the entire submission and locks the creator's account pending human review.
Workspace secrets (API keys, tokens, env vars) are encrypted at rest using AES-256. Bring Your Own Key (BYOK) is supported for enterprise workspaces — your master key never leaves your infrastructure. During runbook execution, secrets are decrypted in-memory only, injected into the child process environment, and never written to disk or logged.
All data in our PostgreSQL database is protected by Supabase Row-Level Security. No server-side query can access another user's private library, workspace secrets, or acquisition history. Every query is scoped to the authenticated user's identity at the database level — not the application level — eliminating entire classes of misconfiguration vulnerabilities.
Prompt Injection & Red-Teaming
AIMD does not censor the content of AI system prompts — many legitimate red-teaming, security research, and adversarial testing workflows require jailbreak-style instructions. We trust the developer community to use these responsibly.
If you are deploying a purchased system prompt into an enterprise environment, we strongly recommend reviewing the raw prompt text before execution. Look for hidden instruction overrides, social engineering hooks, or unexpected tool-call triggers.
We do not sell your data — ever.
We do not use your library acquisitions to train AI models.
Payment card data is never stored on our servers (handled by PCI-compliant processors).
Session tokens are stored in OS Credential Managers, not plaintext config files.
We do not log the contents of variable values entered during runbook execution.
The AIMD community relies on a combination of self-policing and algorithmic detection. If you encounter a resource that violates our Terms of Service — such as malware, CSAM, or credential-stealing tools — use the Report button on the listing page.
Resources that reach a volume threshold of community reports are automatically suppressed from all Trending and Discovery feeds pending a human moderator review. Confirmed violations result in permanent account termination and DMCA processing where applicable.