Security practices for ForeverLink workspaces and public redirects.
Argon2id/bcrypt password hashing, optional TOTP 2FA, single-use recovery codes, progressive lockouts after failed logins.
HttpOnly cookies, SameSite=Lax, Secure in production, inactivity timeout, session regeneration after login.
CSRF tokens on POST forms, prepared statements, tenant-scoped queries, security headers on admin surfaces.
Only https destinations are accepted. Private and localhost hosts are rejected.
Responsible disclosure via our contact form — please include steps to reproduce.
Contact security