Security

Artifacts are SHA-256 sealed at intake and stored immutably; a manifest hash can be re-verified at any time. Sessions use signed, HttpOnly, SameSite cookies. Owner administration is credential-gated. API keys are stored as keyed SHA-256 hashes and never appear in URLs or logs. All SQL is parameterized and authentication endpoints are rate-limited.