Every endpoint,
hardened.
EternalEngine's API is protected by multiple defensive layers — rate limiting, strict Zod schema validation, parameterized queries, and injection prevention — stacked so that no single bypass succeeds. Production-hardened from the first commit.
Defense in depth — every layer counts
Security isn't one mechanism. It's multiple overlapping controls so that no single bypass leads to a breach.
Rate Limiting
Per-IP sliding window rate limits protect every endpoint from brute force, scraping, and denial-of-service abuse. Burst allowances accommodate legitimate traffic spikes without impacting genuine users.
Zod Input Validation
Every API request body is parsed against a strict Zod schema. Unknown fields are stripped. Type coercions are rejected. Malformed payloads return 400 before any business logic runs — no data ever reaches the database unchecked.
Parameterized Queries
Every database query uses parameterized statements — never string interpolation. User-supplied values are always treated as data, never as SQL. SQL injection is structurally impossible, not just tested against.
Injection Prevention
Beyond SQL — XSS vectors are stripped at input, command injection is prevented by avoiding shell execution entirely, and path traversal is blocked by strict file access controls. The entire OWASP Top 10 injection surface is addressed.
Hardened for production from day one
You shouldn't have to configure your way to secure. EternalEngine ships with production-grade defenses on by default.
Zero Injection Vectors
Parameterized queries + Zod validation means user input can never become code. SQL injection, NoSQL injection, and XSS are structurally prevented — not just mitigated.
Abuse Protection
Rate limiting stops automated abuse before it affects your data or performance. Brute-force attacks, credential stuffing, and scraping bots hit a wall before they reach your business logic.
Production-Hardened
Every defensive layer was designed by engineers who've operated at scale. Not security added after launch — security baked into every architectural decision from the first line of code.
Common questions, straight answers.
How are requests validated?
Every request body is parsed against a strict schema; unknown fields are stripped and malformed payloads are rejected before any business logic runs.
How is SQL injection prevented?
Every database query uses parameterized statements, so user input is always treated as data, never as SQL.
Is there rate limiting?
Yes. Per-client limits protect every endpoint from brute force and scraping and return 429 when exceeded.
Can I use the API myself?
Yes. API access and webhooks are included on Pro and Business.
Run your business from one place.
Five plans, seventeen launch apps, one dashboard. Set up in under 5 minutes — change tiers any time.
From $0 · Basic $9.95/mo · Save 20% on annual billing · Upgrade or downgrade any time