Security
How the service is locked down, and how to report a weakness.
API keys
Shown once. The stored value is HMAC-SHA256 with the APP_SECRET pepper. Older SHA-256 keys still verify.
Passwords
bcrypt. At least 10 characters. Five failed logins lock the account for 15 minutes.
Sessions
JWTs expire. POST /api/refresh issues a new token without reloading the profile.
Browser
CORS is limited to the site origins. The token cookie is SameSite=Strict. The dashboard sends Authorization and does not rely on the cookie for API calls.
Admin log
Credit changes and other admin actions are written to admin_audit_log.
Reports
Write to security@nestip.net. The full policy is SECURITY.md in the source tree and /.well-known/security.txt.