Security

A short, honest summary of how accounts and data are protected. The full technical write-up lives in the project's SECURITY.md file alongside the source code.

Passwords and sessions

Passwords are hashed with bcrypt, never stored or logged in plain text. Sessions use a signed cookie that page scripts can't read, so it can't be exfiltrated the way a JavaScript-readable token could be.

Database access

Every database query is parameterized, values are never spliced into SQL text, which is what prevents SQL injection regardless of what a person types into a form.

Abuse protection

Login, registration, and password-reset requests are rate-limited per address, on top of a general limit across the whole API, to slow down scripted abuse without affecting normal use.

Reporting a problem

If you find a security issue, email support@qeezox.com with details. We'd rather hear about it from you first.