Security
- Passport credentials are Ed25519-signed; the public key is published at /.well-known/passport-signing-key.json and every verify response carries a freshly signed status attestation, so status cannot be replayed from a stale screenshot.
- API keys are stored only as keyed SHA-256 (HMAC) hashes and are never accepted in URLs.
- Passwords are salted PBKDF2 hashes. Sessions use HttpOnly, SameSite cookies (Secure on the live site).
- All database access is parameterized. Auth, challenge, report and public verify endpoints are rate-limited.
- Owner/admin surfaces require the owner credential; anonymous requests receive no data.
- Secrets exist only in the deployment environment — never in the repository.