> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neus.network/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security best practices for NEUS SDK integrations.

## Auth by operation

| Operation                    | Auth                                                                           |
| ---------------------------- | ------------------------------------------------------------------------------ |
| `POST /api/v1/verification`  | Signed standard string, or advanced server path with access key + `X-Neus-App` |
| `GET /api/v1/proofs/{qHash}` | Public metadata for public/unlisted; private needs owner rules                 |
| Private payload reads        | Owner signature / SDK helpers                                                  |

## Do Not

<Warning>
  * Do not treat proof signatures as bearer tokens (they are request-bound)
  * Do not embed **secrets** in browser bundles
  * Do not call the NEUS API from browser JavaScript with hand-written `fetch` and custom headers; use SDK or Hosted Verify, or **proxy** through your server
  * Do not log or persist:
  * proof signatures
  * API keys
  * third-party auth credentials or provider tokens
</Warning>

## Defaults

`client.verify()` defaults **private**. `VerifyGate` uses Hosted Verify with the published gate policy. [Privacy](../platform/security-and-trust)

If you need proof reuse without owner-authenticated access, opt into unlisted public explicitly:

```javascript theme={"dark"}
const proofOptions = {
  privacyLevel: 'public',
  publicDisplay: false,
};
```

Do not treat unlisted public proofs as secret.

| Control                | Purpose                                                             |
| ---------------------- | ------------------------------------------------------------------- |
| `privacyLevel`         | Default private; switch to public only for intentional public reuse |
| `publicDisplay`        | Discovery vs unlisted                                               |
| `storeOriginalContent` | Advanced storage control                                            |

<Note>
  Unlisted public proofs are still public to anyone with the `qHash`.
</Note>