Argon2id password hashing, TOTP 2FA, CSRF/CSP/HSTS headers, prepared statements everywhere, rate limiting, and full audit logging are built into the platform core.
The current OWASP-recommended password hashing algorithm, used for every account.
Optional TOTP 2FA on every account, with recovery codes for account access.
Standard web-application security headers, enforced platform-wide.
Every database query is parameterized — no raw SQL string concatenation.
Per-key, per-minute rate limits plus daily/monthly quotas on every API request.
Admin and account-level actions are recorded to a real, queryable audit log.