Security and user roles

Accounts and roles#

Administrators can manage privileged configuration, invitations and integrations. Editors manage content but cannot gain administrative rights by revealing a hidden menu link. Permissions are checked on the server. Invitation, disable/re-enable, password reset and session changes follow the account-revocation boundaries. Create individual accounts instead of sharing one administrator password.

Authentication and sessions#

Controls include password hashing, login throttling, expiring single-use email codes, hashed password-reset links, CSRF protection and idle/absolute session limits. Production enforces email verification and a suitable secure mail transport. Session defaults are 30 minutes idle and eight hours maximum. Administrators can configure 5–120 idle minutes and 1–24 maximum hours, with the idle limit no longer than the maximum session. The /manage path is a routing choice, not a security control. Hiding the login URL does not replace authentication, rate limits or patching.

Content and file boundaries#

• The API serialises published public fields explicitly.
• Private drafts and administrator responses are not publicly cacheable.
• Uploaded raster assets are validated and re-encoded; quotas and memory checks bound processing.
• Stored HTML is sanitised and scripts are restricted by the application policy.
• Integration credentials are encrypted separately from public content.
• Backup restore checks paths, limits, checksums and database integrity before staging.

Deployment responsibilities#

Use HTTPS, production debug settings, exact trusted hosts, private environment secrets, a writable private data directory and public/ as the only document root. Shared rate-limit and locking storage is needed before horizontal scaling; local SQLite and filesystem locks are not a multi-server architecture. No independent penetration test or healthcare certification is claimed. Mail abuse controls, monitoring, retention and incident-response ownership need a production review. Report vulnerabilities privately to the maintainer, never with live credentials in public messages.