PromptConduit Auth Hardening
If your company puts an AI coding analytics tool behind SSO or shared accounts, the security questionnaire is only the start. You still need to know what happens when someone is deactivated, when a bot floods sign-in, or when a session token lands in a browser URL.
PromptConduit is a TypeScript API on Cloudflare Workers with D1. Sign-in is OAuth with Google and GitHub on the web, plus an RFC 8628 device flow for promptconduit login. There is no password login, no refresh tokens, and no SAML. I still had gaps worth fixing. Three PRs merged in our private platform repo on October 14, 2026: #244, #245, and #247. I cannot link the repo here. This post is what shipped.
PromptConduit now rejects deactivated or soft-deleted users on every credential check (#244), rate-limits unauthenticated auth endpoints by IP (#245, with exchange added in #247), and uses PKCE on Google/GitHub sign-in plus a one-time exchange code so the JWT never rides in the redirect URL (#247). Ask any vendor in this space for the same behaviors.