Internal Infrastructure Control Practices

Overview

This section details authentication security, rate limits, session management, and API endpoints validation checks.

Security Protocols

• Session Tokens: Authentication tokens are stored inside HTTP-Only, Secure cookies to prevent Cross-Site Scripting (XSS) retrieval.
• Rate Limiting: Endpoints are protected against brute-force calls using API request velocity caps:

Auth routes: Capped at 5 requests/minute per IP
Audit routes: Capped at 15 requests/minute per user

User Responsibilities

• Enable Two-Factor Authentication (2FA) inside settings.
• Verify magic link login requests are originating from your own device actions.