Security settings

Authentication

Secure token-based authentication with multiple layers of protection:

• HTTP-only, secure cookies prevent XSS token theft.
• Sessions expire automatically after a configurable inactivity period.
• Admins can revoke any active session from the security panel.
• CSRF tokens protect every state-changing request.

Password policies

Enforce strong password requirements from Settings → Security:

Data encryption

All data is encrypted both in transit and at rest:

Security headers

The platform enforces strict browser-level protections:

• Content Security Policy (CSP) — prevents XSS by restricting script sources.
• X-Frame-Options — blocks clickjacking by preventing embedding in iframes.
• Strict-Transport-Security (HSTS) — forces HTTPS for all connections.
• X-Content-Type-Options — prevents MIME-type sniffing.