Most AI chatbot templates trust the browser more than they should — exposed API keys, system prompts overridable via curl, CORS headers that only block browsers, not scripts.
WidgetForge flips that: API key stays server-side, system prompt rebuilt on every request, CORS enforced with a real 403, two-tier rate limiting plus a daily cost ceiling.
5 AI providers, 4 themes, HTML + Next.js. One config file. Built for real client sites, not demos.
