Security

We use Secure, HttpOnly, SameSite=Lax session cookies. Production secrets are owned by Program Control and stored only in the hosting provider, never in this repository.

See the security procedures in Secret ownership and rotation.