Security Policy

We use hashed passwords, secure session cookies, CSRF protection, rate limiting and input validation, and we keep secrets in server-side environment variables — never in frontend code.

If you find a security vulnerability, please report it responsibly through the contact form marked 'Security', and give us a reasonable time to fix it before public disclosure.