Security Status

Restricts which scripts, styles, and resources can load.

Forces HTTPS for 2 years, including subdomains.

Prevents the app from being embedded in iframes.

Stops browsers from guessing file types.

Isolates browsing context from cross-origin windows.

Blocks cross-origin resource embedding.

Controls how much URL info is sent in Referer headers.

Disables browser APIs the app doesn't use.

120 requests per 60 seconds per IP across all routes.

30 requests per 60 seconds per IP on /api/* routes.

5 failed attempts triggers a 5-minute IP lockout.

All API inputs stripped, escaped, and size-limited.

Username, password, and action fields validated by regex.

SQL, NoSQL, and path traversal patterns blocked.

JSON bodies capped at 10KB, login bodies at 1KB.

Proxy blocks malicious patterns in request paths.

Every security event is logged with IP, UA, and request ID.

Browser reports blocked script injections to /api/csp-report.

Every response has an X-Request-Id header for log correlation.

Installable on iOS and Android from the browser.

Static assets cached, API routes always network-first.

X-Powered-By and Server headers stripped from all responses.

Known security scanner user-agents blocked at proxy.

Credentials are hardcoded for demo purposes.

Rate limit counters reset on server restart / new instance.

Audit events are lost on server restart.