Designed around the sensitivity of trust.
Layered account, application, database and deployment controls protect private relationship data.
Accounts and sessions
Passwords use an adaptive one-way hash. Sessions use high-entropy opaque tokens, secure HTTP-only cookies, rotation-ready storage, device history and immediate revocation. Login attempts are throttled and suspicious activity is audited.
Application security
Every protected read and write verifies the actor and relationship membership. Validation, parameterised database access, output escaping, request limits, security headers and restrictive browser policies reduce common web risks.
Sensitive fields
Highly sensitive values use authenticated AES-256-GCM encryption with environment-supplied keys and rotation support. Secrets, passwords, session tokens and private content are excluded from logs and analytics.
Infrastructure
Containers run with health checks, internal networking and persistent volumes. The application respects trusted proxy headers and secure cookies behind Cloudflared, Nginx, Caddy or Traefik.
Reporting vulnerabilities
Send a concise report through the contact page under Security. Do not include real user data, exploit production accounts or publicly disclose an unresolved issue.