Account & security
How account access and local data are protected.
Account isolation
Each account can read and manage only its own projects and audit reports. Sessions use random tokens stored as hashes on the server. Session cookies are HttpOnly and SameSite; HTTPS deployments also use Secure cookies.
Passwords and integrations
Passwords are salted and hashed with scrypt. Search-provider keys use AES-256-GCM encryption with a server-side key stored outside tracked source files. Password reset and email verification are not available in this local edition.
Public destinations only
The collector rejects private, loopback, link-local, metadata, and reserved addresses. HTTP redirects repeat DNS validation. Browser traffic passes through a local proxy that resolves, validates, and pins public destinations before connecting.
Storage and deployment
Accounts, sessions, projects, and reports are stored in the local SQLite database. Keep this local installation bound to loopback. Public production hosting needs HTTPS, backups, operational monitoring, and a deployment security review.