Security

Safeguards

• Passwords are stored as one-way hashes and verification/reset links expire.
• Access is tenant-scoped, sensitive endpoints validate origin, and abusive requests are rate-limited.
• Email provider webhooks require cryptographic signatures and duplicate events are ignored.
• Provider credentials remain server-side and are not included in browser messages.

Your role

Use a unique password, keep verification links private, and report unexpected account activity to [email protected].