Security
Authentication, CSP, rate limiting, and security model.
Security Model
Authentication
- Session-based auth (not JWT)
- bcrypt password hashing
- Session cookies are httpOnly + secure
- No third-party auth providers needed
Security Features
- CSP Headers: Content Security Policy headers (currently in Report-Only mode)
- Rate Limiting: API and form submission rate limiting
- Bot Detection: Basic bot/crawler detection for analytics
- CSRF Protection: All form submissions are CSRF-protected
- Input Validation: All inputs validated via Zod schemas
Reporting Security Issues
If you find a security vulnerability, please do not open a public issue.
Email: [email protected]
We respond within 48 hours.