Security

Current application safeguards

• Restricted pages are checked by the server before they are returned.
• Authentication uses server managed sessions rather than browser storage as proof of identity.
• Session cookies are HTTP only, use strict same site handling, and require secure transport in production.
• Login attempts are rate limited and state changing account requests require the same origin.
• Public administrator registration and arbitrary page editing are disabled.
• Security headers restrict framing, content sources, referrer information, and browser feature access.
• Automated tests verify protected pages, session creation and destruction, origin checks, disabled administrative routes, and public crawl boundaries.

What Pryzem does not claim

No internet service can guarantee absolute security. Pryzem does not describe communications as end to end encrypted unless and until that capability is independently verified and clearly documented.

Report a security concern

Send a concise description to [email protected] with the subject “Security report.” Do not include passwords, authentication codes, private keys, sensitive service records, or unnecessary personal information.

Good faith reports should describe the affected page or feature, the observed behavior, the potential impact, and safe reproduction steps. Do not access another person's information, disrupt availability, or perform destructive testing.

Account safety

Use a unique password, protect access to your email account, sign out on shared devices, and contact Pryzem promptly if you suspect unauthorized access.