Account protection
Sign-in uses Supabase Auth (GoTrue) with JWT sessions. Tokens are stored in HTTP-only, Secure, SameSite cookies via the Supabase SSR client. Sign-in via Google or Apple uses OAuth 2.0 / OIDC; we never see provider passwords.
Passwords (when email/password sign-up is used) are hashed with bcrypt at industry-recommended cost. We never log or transmit plaintext passwords.
Sensitive actions (password change, account deletion) can require re-authentication or a one-time email code. Suspicious activity triggers rate limits and may trigger account review.