Designed to keep boundaries clear.

Meridian is structured so that provider credentials never enter the browser. Requests pass through a same-origin serverless endpoint before reaching the AI gateway.

Credential handling

The OmniRoute bearer token is held as a Vercel environment variable and is only read inside the serverless function. It is never embedded in HTML, JavaScript, or local storage.

Application safeguards

• Input size and conversation length are capped before provider routing.
• Output token caps limit accidental over-generation and cost exposure.
• Security headers prevent framing and MIME-type sniffing.
• Chat history exists only in the active browser tab.

Local profile

The optional profile stores only a display name, email, and timestamp in this browser. Passwords are neither collected nor stored.