Security

PRISM keeps the short-lived access token in memory and the refresh token in an HttpOnly cookie. Passwords are hashed with Argon2id. Paid checkout is handled by Stripe; we do not store card numbers.

Admin access can require an authenticator app. Sign-in attempts are rate limited, and repeated failures on one account are slowed down. Database backups are stored off the application server.

Report a security issue to [email protected]. Please do not post exploit details in public until we have had a chance to respond.