Passkey-first access
WebAuthn public-key credentials with user verification, one-time challenges and replay controls.
Trust by designAuthentication Browser security Sessions Forms Media Privacy
Premium experience. Serious security.
The platform is designed around passkeys, strong origin checks, strict browser security policies, rate limiting, CSRF protection, secure cookies, audit logging and controlled media intake.
Strict policy surface
Content Security Policy, no inline scripting, frame protection, HSTS in production and restrictive permissions policy.
Protected account state
HttpOnly, Secure, SameSite=Strict cookies and server-side session storage.
Origin + rate controls
Host/origin validation, bounded request bodies, endpoint throttling and CSRF validation for authenticated mutations.
Controlled uploads
Extension, signature and file-size validation with randomized storage paths outside the public media catalogue.
No third-party tracking
The core experience requires no external analytics, viewer or advertising scripts.