Security

Identity & Access Management

Authentication, authorization, and session controls.

Authentication

Email and password (bcrypt with SHA-256 pre-hash), OAuth SSO (Google, Microsoft, and others), SAML SSO (enterprise),
primary passkey login, and MFA (TOTP, email OTP, WebAuthn second factor, recovery codes).

Local password policy (NIST SP 800-63B)

User-chosen passwords for signup, password reset, and account recovery follow NIST SP 800-63B memorized-secret guidance:
8–256 characters, any characters allowed (no mandatory uppercase, digits, or symbols), Unicode normalized (NFC),
screened against a local common-password blocklist and the Have I Been Pwned (HIBP) k-anonymity API before acceptance.
If breach screening is unavailable, password changes are blocked (fail closed) rather than accepted without a check.
Passwords are never stored in plaintext; bcrypt (cost factor 10) hashes a SHA-256 digest of the normalized password
so long passphrases are not truncated by bcrypt's 72-byte input limit. Existing accounts rehash to the digest form on next login.

Roles

Owner, Administrator, and Member roles govern organization access. Permissions are enforced at organization, workspace, and room levels.
Production uses the enterprise RBAC policy engine and feature-matrix entitlements in enforce mode (blocking denials).
Staging inventory matches production enforce settings.

Authorization rollout

Inventory drift checks, observe-mode comparison harness, feature-entitlement route audit, and OpenAPI contract drift
run in continuous integration. Security assessment probes verify RBAC enforce mode and backup freshness in production.

Session security

Sessions use HTTP-only cookies with Secure and SameSite=Lax in production. Sessions invalidate on password change and sign-out.