Security Built In.
Not Bolted On.
Enterprise-grade security at every layer. JWT authentication, RBAC, API key management, rate limiting, and OWASP Top 10 compliance.
Defense in Depth
8 security layers
Dual-Cookie Auth
httpOnly JWT cookie + client session cookie. SameSite=Strict, Secure flag, and CSRF protection.
API Key Management
Hashed storage, prefix format (uix_ak_), rotation, revocation, and scoped permissions.
RBAC
Role-based access control with admin, editor, viewer, and custom roles.
Rate Limiting
Sliding window rate limiting on all auth endpoints. Configurable thresholds per route.
Audit Logging
Structured security event logging. Login/logout, token events, and suspicious patterns.
TLS Everywhere
End-to-end encryption. HTTPS enforced, HSTS headers, and Cloudflare edge TLS.
Input Validation
Zod design checks on every API endpoint. No unvalidated input reaches the database.
Token Rotation
JWT expiry management, refresh token rotation, and credential lifecycle controls.
Compliance
Standards and best practices
OWASP Top 10 compliance
Injection, broken auth, XSS, CSRF, and all 10 categories audited.
Dependency scanning
Automated CVE scanning with npm audit and GitHub Dependabot.
Security headers
CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
Secret management
Three-tier flow: local .env, Docker deploy, GitHub Actions CI/CD.
Non-root containers
Docker images run as non-root users with minimal permissions.
SQL injection prevention
Drizzle ORM parameterized queries. No raw SQL concatenation.
Supply chain
Dependency audit
Trust starts with security
Your data, your designs, your code — protected at every layer.