Security

Accounts and sessions

• Passwords are hashed with scrypt and a unique salt. Plain passwords are never stored
• Sessions use a random token in an httpOnly, same-site cookie. Only a hash of the token is stored, so a leaked database cannot be used to sign in
• Changing or resetting a password signs out every other device
• Reset links work once and expire after one hour

Abuse protection

• Login attempts are limited per visitor and per account, and an unknown email takes as long to answer as a known one
• Sign-up, password reset, contact form, AI questions, event collection and API keys all have rate limits
• Write requests must come from the same site, which blocks cross-site request forgery
• The redirect after login only follows paths on your own site

Data separation

Every record belongs to a workspace, and every query filters by the signed-in person's active workspace. The automated tests check that one workspace can never read, change or delete another's customers, notes, events, views, alerts, keys or invoices.

Roles

Support access

The optional admin area at /admin can open a workspace as one of its members for support. The session lasts two hours, shows a banner on every screen, and writes an entry to that workspace's activity log so customers can see it.

Public sharing

A shared report link shows only the numbers in that saved view. It never shows customers or notes, can be switched off at any time, and a new link is issued each time sharing is turned back on.

Before you launch

1. Keep ORBIT_DEMO off
2. Set APP_URL, and use a strong CRON_SECRET
3. Rotate any key that was ever pasted into a chat or committed to git
4. Add a content security policy and security headers for your domain if your policy requires them
5. Review the privacy policy against what you actually collect