Authorization codes expire in five minutes, are one-time use, and require the S256 verifier. Every access token is resource-bound to the v1 endpoint.
Security center
Security claims, including the limits.
PrimeSync Studio is OAuth-gated and bounded, but it has not completed an independent security audit. This page separates implemented controls from work that is still outstanding.
Implemented controls
Build, audit, and validation permissions are approved separately. A missing scope is rejected before tool work begins.
Access tokens last up to 1 hour. Refresh tokens last up to 30 days, remain bound to the same client and resource, and can be revoked with the full connection at any time. Temporary reviewer sessions have an absolute 8-hour limit.
Access tokens, refresh tokens, and authorization codes are stored as SHA-256 hashes, not plaintext.
30 calls per minute per OAuth session and 5.5 MB per MCP request. Validation uses deterministic in-process computation only.
Question balances are enforced on the server. Guest identity is keyed by server-controlled connection metadata, and purchased-credit events are applied once using their unique event identifier.
No submitted-code execution, shell, broker, TradingView account, exchange, order, or market-data network access exists in the MCP tools.
Optional memory controls
Memory requires its own permission and explicit enablement. Reads and changes are bound to the authenticated account; project revisions and profile versions reject stale writes. Shared reviewer accounts cannot persist personal data. Turning off memory erases preferences and project summaries. Account mutations require same-origin requests. These controls are covered by application tests, not an independent security certification.
Current assurance status
PublisherPrimeSync Project · [email protected]
Named legal operatorנביה חיר · Israel
Domain relationshipprimesync.me links directly to ai.primesync.me and uses the same support domain.
Developer-platform identity verificationMust be completed in the submission portal before directory review
Independent security reviewNot completed
Public bug bountyNot established
Public source repositorySource is currently private
Recognized MCP directoryNot yet published; review materials are being prepared
Do not describe PrimeSync Studio as independently audited, SOC 2 certified, TradingView endorsed, or directory-approved. None of those claims is currently true.
Report a vulnerability
Email [email protected] with the affected endpoint, impact, reproduction steps, and a safe proof of concept. Do not include live credentials or other people's strategy code.