Security

We follow production-quality security practices: secure password hashing (bcrypt), JWT-based authentication, role-based access control separating admin and user data, rate limiting, and strict input validation.

Our website scanner includes SSRF protection: it validates URLs and refuses to fetch private, loopback, link-local or internal-network addresses.

API keys and secrets are never exposed to the client. All requests occur over HTTPS.