Security

Sessions and access

Protected routes check server-side sessions. Admin operations require elevated role checks and are written to audit logs.

Uploads

Files are validated for size, type, ownership, and allowed extensions before storage and downstream processing.

Secrets

Private API keys and webhooks are never sent to the browser. Only publishable client keys may use NEXT_PUBLIC_*.

Monitoring

Errors are captured with PII scrubbing, while webhook signatures, rate limits, and CSRF controls reduce abuse risk.