Product · Security
Hand the keys to an agent. Keep the control.
Every request is authorized on the server against the user's role and the token's scopes, secrets are never stored in plain text, and every write is logged.
Part of our guide What is an agentic CMS.
Audit log · bakeryandco.com
- success
entry.publish
Mira Okafor · editor
- success
entry.update
Agent (OAuth) · author
- denied
entry.publish
Agent (OAuth) · author
- success
content_type.update
Mira Okafor · admin
Scoped OAuth
Agents get read, write, publish or admin, never more than their user.
No plain-text secrets
Sessions, invitations and API keys are hashed; webhook secrets are encrypted.
Audit log
Actor, action, resource and outcome for every write and publish.
01Built-in protections
Sign-in can be rate limited, passwords are hashed with PBKDF2 and a per-user salt, and media imports refuse private, loopback and other non-public addresses, including after redirects.
02Tested
The codebase carries 1,121 automated tests across contracts, domain services, the database layer, the server and the admin, including tenant isolation and permission checks.
Questions
Where does my data live?
Content and settings are stored in Cloudflare D1 and media in Cloudflare R2.
Back to the guide: What is an agentic CMS?
Keep exploring