Sessions
Tokens are random, stored as SHA-256 hashes, and expire.
Security
Controls that sit in the request path.
Hashed passwords, hashed session tokens, CSRF on mutating routes, workspace authorization, and localhost-only production binds.
CSRF
Cookie plus header comparison on state-changing API calls after login.
Authorization
Workspace and conversation membership is checked on the server.
Secrets
DATABASE_URL and provider keys stay in VPS env files, never NEXT_PUBLIC_*.
Network
Production API binds 127.0.0.1:3033. PostgreSQL is not exposed publicly.