Security

Authentication, CSP, rate limiting, and security model.

Security Model

Authentication

  • Session-based auth (not JWT)
  • bcrypt password hashing
  • Session cookies are httpOnly + secure
  • No third-party auth providers needed

Security Features

  • CSP Headers: Content Security Policy headers (currently in Report-Only mode)
  • Rate Limiting: API and form submission rate limiting
  • Bot Detection: Basic bot/crawler detection for analytics
  • CSRF Protection: All form submissions are CSRF-protected
  • Input Validation: All inputs validated via Zod schemas

Reporting Security Issues

If you find a security vulnerability, please do not open a public issue.

Email: [email protected]

We respond within 48 hours.