Authentication
Passwords are hashed with PHP's current password hashing implementation. Sessions use HttpOnly cookies and regenerate after successful login.
Security controls you can verify
We only describe controls implemented in this build or operational requirements that must be configured before production.
Request integrity
State-changing forms and API requests use CSRF tokens. Login, registration and password-reset flows include IP-based rate limiting.
Transport security
Production must run over HTTPS. When HTTPS is active, the application sends an HSTS header and marks the session cookie Secure.
Data isolation
Project queries are scoped to the authenticated user. Administrative views require the admin role.
Credentials
Database and transformation-service credentials are stored in server-side configuration and blocked from direct HTTP access.
Audit events
Key authentication, privacy and administrative actions are recorded with timestamp, IP and user agent for security review.
Shared responsibility
TUNCBA cannot make an insecure deployment secure by policy text alone. cPanel permissions, database backups, TLS, mail security, server patching and production transformation infrastructure must also be maintained correctly.
Report a security issue