Jump2PipeWorkspace ↗Security
Current protections and open work
Account protection
Passwords are salted and hashed with Argon2id. Only hashes of random session tokens are stored in PostgreSQL. Cookies use Secure, HttpOnly, SameSite=Strict, and the __Host- prefix. Mutating requests require an exact allowed Origin.
Isolation
Database queries bind all values. Preferences and audit queries are scoped to the authenticated user. Passwords, tokens, and private file contents are not included in audit events.
Development limitations
Email verification, password reset, MFA, distributed abuse controls, dependency auditing, and independent security review remain incomplete. Avoid sensitive workloads. No mesh, tunnel, or file encryption claims apply to this release.
Encryption boundaries
Planned HTTPS public tunnels terminate TLS at the gateway and must not be described as end-to-end encrypted. Private mesh and file transport will require established end-to-end encryption and real-device validation.
Disclosure
A dedicated security contact must be configured before commercial launch. No vulnerability reporting mailbox is currently advertised.