Boring, on purpose.

bcrypt with a work factor of 12. Passwords are never logged, never returned by an API, and never recoverable — only replaceable.

Failures are counted per account and trigger a progressive lockout, so an attacker cannot grind a single account.

Addresses are verified with single-use, expiring tokens before an account is treated as established.

TOTP via any authenticator app, with backup codes issued once at enrollment and stored hashed.

Platform administrators are required to enroll in two-factor authentication. It is not optional and cannot be skipped.

Access tokens live one hour. A leaked one has a small window and cannot be extended.

Refresh tokens are single-use and replaced on every exchange, so a replayed refresh is detectable and useless.

Any session can be revoked individually or in bulk, and revocation takes effect on the next request rather than at expiry.

Session and reset tokens are stored hashed. A copy of the database does not yield usable sessions.

HttpOnly, Secure and SameSite on every cookie we set. Administrative sessions are capped at eight hours with SameSite=Strict.

Every third-party flow uses a code challenge, so an intercepted authorization code cannot be exchanged.

State values are bound to one flow and expire. Replaying a callback does not produce a session.

Codes are only delivered to URIs registered for that client. Matching is on scheme, host and path.

Query parameters you embed in a redirect URI are preserved exactly, so your own CSRF state survives the round trip.

Sliding-window limits on sign-in, password reset and OAuth initiation, enforced centrally rather than per instance.

HTTPS only, with managed certificates and HSTS. Plain HTTP is redirected, never served.

Exceptions are captured and alerted on, so failures are found by us rather than reported by your members.

Expired tokens, states and sessions are purged on a schedule instead of accumulating indefinitely.

Sign-ins, failures, lockouts, verifications, resets and administrative actions are appended to a log the application never rewrites.

Entries record the actor, the client, the IP and the user agent, so "who did this" has an answer.

Filter by action, client, user or date range in the dashboard, and export the result.

When an administrator unlocks an account or revokes a session, that is an audited event like any other.

Runs on Microsoft Azure App Service with a managed PostgreSQL database and restricted network access.

TLS in transit; database and blob storage encrypted at rest by the platform.

Credentials live in platform configuration, not in the repository, and are rotated independently of deploys.

Each client’s users, sessions and audit entries are scoped to that client and queried through ownership checks.