Security information

Implemented controls

• Passwords are hashed using scrypt.
• Selected database fields are encrypted with the configured Fernet key.
• Private account and admin API routes require bearer-token authentication; admin broadcast API routes enforce admin identity.
• The calculator uses a bounded Decimal parser rather than evaluating arbitrary code.
• Production deployment terminates HTTPS at Nginx when correctly configured.

Limitations

The current admin login uses bearer tokens and does not yet implement MFA, role-based access control, CSRF-protected browser sessions, or a comprehensive audit log. There is no published incident-response SLA, external security audit, or certification. Do not treat encrypted database fields as protection from a compromised application host or key.

Configuration responsibilities

Operators must keep bot tokens, application secrets, and the encryption key out of source control and frontend code, restrict server access, back up the encryption key securely, and update dependencies. Losing or changing the encryption key without a migration makes encrypted data unreadable.

Report a suspected vulnerability through the configured support contact. No support contact is configured on this installation.