Authorization codes expire in five minutes, are one-time use, and require the S256 verifier. Every access token is resource-bound to the v1 endpoint.
Security center
Security claims, including the limits.
PrimeSync AI Studio is OAuth-gated and bounded, but it has not completed an independent security audit. This page separates implemented controls from work that is still outstanding.
Implemented controls
Build, audit, and validation permissions are approved separately. A missing scope is rejected before tool work begins.
Access tokens last up to 1 hour. Refresh tokens last up to 30 days, remain bound to the same client and resource, and can be revoked with the full connection at any time. Temporary reviewer sessions have an absolute 8-hour limit.
Access tokens, refresh tokens, and authorization codes are stored as SHA-256 hashes, not plaintext.
30 calls per minute per OAuth session and 5.5 MB per MCP request. Validation uses deterministic in-process computation only.
Website question balances and the separate 50-job Studio monthly allowance are enforced on the server. Studio verifies the purchasing Whop identity before analytical work; failed jobs do not consume an analysis. Guest identity is keyed by server-controlled connection metadata, and purchased-credit events are applied once using their unique event identifier.
No submitted-code execution, shell, broker, TradingView account, exchange, order, or market-data network access exists in the MCP tools.
Optional memory controls
Memory requires its own permission and explicit enablement. Reads and changes are bound to the authenticated account; project revisions and profile versions reject stale writes. Shared reviewer accounts cannot persist personal data. Turning off memory erases preferences and project summaries. Account mutations require same-origin requests. These controls are covered by application tests, not an independent security certification.
Current assurance status
PublisherPrimeSync Project · [email protected]
Named legal operatorנביה חיר · Israel
Domain relationshipprimesync.me links directly to ai.primesync.me and uses the same support domain.
Developer-platform identity verificationOpenAI approved the submitted v1.0.1 release in October 2026. Platform verification does not constitute an independent security audit.
Independent security reviewNot completed
Public bug bountyNot established
Public source repositorySource is currently private
Recognized MCP directoryThe v1.0.1 submission was approved by OpenAI. Listing availability and approval of later tool updates are controlled by the platform.
Do not describe PrimeSync AI Studio as independently audited, SOC 2 certified, TradingView endorsed, or independently security-certified. Platform submission approval is separate from those assurances.
Report a vulnerability
Email [email protected] with the affected endpoint, impact, reproduction steps, and a safe proof of concept. Do not include live credentials or other people's strategy code.