Security

• Passwords are hashed with bcrypt (cost 12). We never store or log them in plain text.
• Sessions are signed, HttpOnly, SameSite=Lax cookies that JavaScript on the page cannot read.
• After repeated wrong passwords an account is locked for 15 minutes, and sign-in attempts are rate-limited per IP.
• API keys are stored only as SHA-256 hashes; we can't show a key again after creating it.
• Uploads are checked by content, not by name; scriptable formats (SVG, HTML) are refused and files are served with strict headers.
• Every page is sent with a Content Security Policy, HSTS, clickjacking protection and a strict referrer policy.

Keeping your account safe

• Use a unique password; the strength meter on sign-up helps.
• Turn on Streamer mode in Account → Settings → Interface before streaming.
• Revoke API keys you no longer use.