This proxy forwards user-provided DeepSeek API keys from Cursor to DeepSeek.

• The proxy does not intentionally write API keys to files, databases, or normal application logs.
• The Authorization header is forwarded to DeepSeek for each request.
• Reasoning cache keys are scoped with a SHA-256 hash of the Authorization header.
• The hash is used to separate users' cached reasoning content, not to recover API keys.

Because requests pass through the proxy server, the server operator is technically capable of inspecting request headers by changing code, adding logs, using debugging tools, or capturing traffic on the host.

Only use a deployment operated by someone you trust.

• Run the service behind HTTPS.
• Do not commit real domains, tokens, .env files, virtual environments, logs, or system service files containing production secrets.
• Use a strong OWNER_TOKEN if the owner path should stay private.
• Keep public concurrency and rate limits enabled before sharing the public endpoint.

If you find a security issue, avoid posting secrets or API keys in public issues. Open a private report or contact the maintainer directly.