Administrative access

Admin access uses server-side sessions and a hashed password. Production secrets must never be placed in public JavaScript.

Data protection

SQLite and CSV data live under the server data directory and are blocked from public static serving. Report security concerns to [email protected].