Security

• Passkeys (WebAuthn) with Face ID, Touch ID, or security keys — phishing-resistant by construction.
• Passwords are verified by the auth backend; the website never stores a plaintext password.
• Google and GitHub linking uses state plus PKCE, and only the refresh token reaches the auth backend.

• PKCE (S256) is mandatory on every authorization. There are no client secrets to leak.
• ID tokens and JWT access tokens are RS256 and verifiable offline against the published JWKS.
• Default access tokens are opaque, stored as SHA-256 hashes, live 12 hours, and die instantly when you disconnect the app. JWT-format tokens (15 minutes) stay valid until they expire — that’s the tradeoff, stated plainly.
• Refresh tokens rotate on every use. The old one works 30 seconds for retried requests; reuse after that revokes the whole authorization as presumed theft.
• Revoking any token ends the entire authorization, including the app’s backend token. Your own session is untouched.

• Session cookies are HttpOnly, SameSite=Lax, and Secure in production.
• HTTPS with HSTS in production. Security headers (no sniffing, no framing) are set on every response.
• Rate limits are enforced by the auth engine, and security events are logged.

The best recovery is set up before you need it — see Recovery. Short version: keep two sign-in methods. If you lose one, sign in with the other and fix it in Security settings.

No SOC 2, no penetration-test report, no bug-bounty program — yet. If your threat model needs any of those, that demand is what schedules them.