Protected credentials
Passwords are hashed with Argon2id and are never stored or logged in plaintext.
Trust is part of the learning experience.
OpsPath is designed to protect learner accounts, preserve progress, and keep administrative controls behind explicit server-side authorization.
OUR CONTROLS
Security built into every layer.
These controls are part of the application architecture, not a post-launch checklist.
Secure sessions
Auth.js uses encrypted JWT sessions with secure, HttpOnly, SameSite cookies in production.
Server-side authorization
Learner and administrator permissions are checked on the server for every protected action.
Validated data access
Zod validates untrusted input and Drizzle uses parameterized queries with relational constraints.
Hardened delivery
HTTPS, HSTS, CSP, frame denial, content-type protection, and restrictive browser policies are enabled.
Accountability
Important administrator changes create audit records so curriculum and access changes are reviewable.
SAFE PRACTICES
What we ask of operators.
Production credentials belong in Vercel and Turso environment settings—not source code, screenshots, chat messages, or committed files. Database migrations are reviewed and applied explicitly, and destructive sample seeding is reserved for empty development databases.
Run dependency audits before releases and rotate exposed credentials immediately. Keep the first administrator bootstrap command one-off, then remove its temporary password from the shell environment.
Known limitations
The login rate limiter currently uses process memory and should be moved to a durable shared store before horizontal scaling. Transactional password-reset email is not enabled until an email provider is approved.
Learn more about OpsPath