Secrets stay private
AI keys and SMTP credentials belong in private server configuration outside public_html, never in generated client-side JavaScript.
Security through controlled generation
Reduce avoidable risk by controlling what the generator emits.
Omega favors static-first output, private server configuration, strict path handling and validated generated files instead of placing secrets or unrestricted AI-generated code in the browser.
Security architecture
Security principles in the architecture
The safest code is often the code a website does not need.
AI cannot bypass code generation
External planning data is schema-constrained and validated before the Omega engines use it.
Path validation
Preview, export and project-storage paths are constrained to prevent generated requests from escaping their project workspace.
Static-first output
Ordinary static pages reduce the server-side attack surface when a project does not require a backend.
Optional form backend
Server-side contact handling can be generated only when required and should use authenticated SMTP/private credentials.
Fail closed
Known generation or preview failures can block export instead of being ignored.
Deployment responsibility
Security continues after export.
The generated site can provide good defaults, but the final hosting environment still matters.
Protect private files
Keep secrets, backups and private data outside the public document root.
Maintain the server
Use supported PHP/server versions and current hosting security updates where backend functionality is enabled.
Review custom integrations
Analytics, third-party scripts, forms, embeds and future edits can introduce new risks after generation.
Build • Rank • Own Your Code
Generate with safe boundaries.
Let AI assist the strategy while Omega retains control of the production output and validation rules.
Dual-platform responsibility
Shared requirements, platform-aware implementation.
WordPress introduces PHP, CMS and update responsibilities that do not exist in a static site. Omega therefore keeps WordPress generation uniquely namespaced and validates that output separately while private credentials remain outside public_html.
Controlled generation boundary
The external AI model is not given authority to execute or directly ship production code.
Omega constrains AI assistance to structured planning and validates the result before deterministic production engines are allowed to build the selected website package.
Same-origin API controls
The Builder API applies session and origin protections designed to reject inappropriate cross-site build requests.
Private project workspace
Active generation data is stored outside the publicly served website directory rather than placing raw project workspaces directly under public_html.
Tokenized preview
Generated previews use high-entropy project/token addressing, path restrictions and noindex controls rather than publishing the temporary build as an ordinary public website.
Preview CSP
The preview route applies restrictive content-security rules to limit arbitrary network requests, external scripts, form submission and embedded objects during inspection.