Practical safeguards without exaggerated claims.

Included application safeguards

• Password hashing using PHP's password hashing API
• Session-based authentication with secure cookie settings when HTTPS is active
• CSRF tokens for state-changing forms
• Server-side validation and output escaping
• File locking for the supplied local data store
• Direct web access blocked for the storage directory through .htaccess

Hosting requirements

Deploy both domains over HTTPS and keep PHP updated. Server and hosting security remain part of the operator's responsibility.

Never send these to support

Passwords, online-banking credentials, complete payment-card details, one-time codes, private keys or cryptocurrency recovery phrases.