Security

Controls implemented

• Argon2id password hashing; secrets only ever stored as hashes.
• HttpOnly session cookies (SameSite=Lax, Secure in production) plus double-submit CSRF tokens.
• SHA-256 API key storage; plaintext shown once at creation.
• Backend-enforced RBAC (USER / SUPPORT / ADMIN) and per-resource ownership checks.
• Zod validation on every request boundary; Prisma parameterized queries.
• Rate limiting on auth endpoints and job submission.
• Helmet security headers; CORS restricted to the configured app origin.
• Webhook signatures verified before processing; events deduplicated.
• Audit log for security-relevant actions and all admin mutations.

Reporting

Report vulnerabilities to the address in your deployment's security.txt / support channel. Do not open public issues for unpatched vulnerabilities.