Sessions invalidate via tokenVersion; passwords hashed; private routes stay out of the sitemap.
We do not publish secrets, auth cookies, or tokens in evidence or chat.
Additional operational detail may remain draft until external audit.
Security
Security practices for account, session, and tenant isolation.
Autor: Miguel Neumann · Geprüft: 2026-07-30 · Geändert: 2026-07-30
Status: Status: draft — claims pending additional evidence. · Methodik