Security

Authentication uses hashed passwords, secure cookies, CSRF-safe Auth.js flows, role-based admin access, rate limiting, and server-side authorization. Provider secrets never leave the server.