Security

Application controls

• Argon2 passwords, breach-password checks, short-lived RS256 access credentials.
• Server-side session-family revocation, single-session policy, idle and absolute expiry.
• One-use hashed verification tokens expiring after one hour; verification does not log in.
• Current persisted account status, role, and email-verification checks at authorization.
• Hashed API keys with cryptographically random 192-bit secrets, quotas, and rate limits.
• CSRF protection, safe redirect validation, shared free-text validation/sanitization, escaped rendering, and browser security headers including CSP.
• Integer credit ledgers, idempotent grants/redemption, and synchronous security writes.

Credentials and deployment

Provider credentials use encrypted vault storage with operator-configured key material. Protect database tokens, JWT keys, Redis credentials, vault keys, mail credentials, and cron secrets. HTTPS and infrastructure access controls remain deployment responsibilities; application code does not prove a specific cloud topology or external certification.

Password and session management

Settings password changes require the current password and a validated replacement. Successful changes revoke sessions and require a fresh sign-in. Logout invalidates the server-side family, including rotated credentials.

Privacy workflow status

Account export/deletion endpoints currently acknowledge requests; they do not perform complete portability or persisted erasure. Automated retention, residency guarantees, and compliance attestations require separate implementation and operational confirmation. Do not infer them from an architecture proposal.

Reporting a concern

Report security concerns privately to your ThreatMap/ZySec security contact. Include the affected route, time, request ID, and a redacted reproduction. Never share passwords, API keys, cookies, or authorization headers in public reports.