Security

Authentication & sessions

• •Argon2id password hashing (OWASP-recommended parameters)
• •Opaque session tokens — only SHA-256 hashes are stored, so a database leak can't steal sessions
• •Optional TOTP two-factor authentication with recovery codes
• •Password changes and resets revoke every other session instantly
• •Email verification and Google OAuth with PKCE

Rate limiting & abuse protection

Every sensitive endpoint is rate-limited (per IP and per resource) via a distributed limiter backed by Redis when configured — brute-force and inbox-flooding attempts are throttled before they reach the database.

Audit trail

Every meaningful action — logins, failed logins, password changes, moderation decisions, admin actions — is written to an immutable audit log with actor, resource, IP and timestamp, so you can always see what happened and who did it.

Data protection

• •Strict row-level scoping — journal and notification queries are always user-filtered (IDOR-proof)
• •RBAC with user < support < admin roles enforced at the API
• •Content moderation: deterministic filters plus AI-assisted review with human decisions
• •TLS everywhere; HSTS with preload in production
• •Security headers: CSP, X-Frame-Options DENY, nosniff, strict referrer policy

Resilience

Provider-gated architecture means a disconnected provider never breaks core flows. The status page reports real service health, and rate limiting gracefully falls back to in-process storage if the cache layer is unavailable.

Responsible disclosure

Found a vulnerability? Report it privately via the contact form — we'll acknowledge it promptly and fix it before disclosure.