This is a description of our actual security posture, including the parts that are not finished. A security page that lists only wins is a marketing page.
Authentication
Sessions are real signed JWTs, verified against our identity service's published keys on every request. There is no development bypass and no fallback identity — if verification fails for any reason, the request is rejected. Auth code fails closed, always.
Secrets
Secrets travel from repository secrets into the environment file at deploy time and are never committed. Required ones are checked before a deploy proceeds, so a missing value fails the run instead of producing a half-configured site. Optional ones are deliberately excluded from that check so an unset feature cannot block a release.
What is not done
Two-factor authentication is not built; accounts are protected by password and email verification only, and the settings page says exactly that rather than showing a disabled toggle. Application ports are still reachable from the wider internet at the security-group level, in front of the reverse proxy. There is no automated test suite. Each of these is a real gap and we would rather you read it here than discover it.
Data
Records live in our Mumbai region with point-in-time recovery enabled — verified against the live tables, not assumed from infrastructure code. Account deletion genuinely erases the account and its published files, retaining only invoices, which Indian tax law requires us to keep and which are stripped of personal data.