Change password

12 characters minimum, three character classes, and every other session is killed on save.

Session

What is enforced

• scrypt password hashing (N=16384, 64-byte key, per-user salt)
• HttpOnly + SameSite=Strict cookie, Secure whenever the request is TLS
• Session tokens stored as SHA-256 digests only
• 8-hour expiry, 30-minute idle timeout
• CSRF token required on every write
• 10 login attempts / 15 min per IP, plus per-account lockout
• Rate limits on API, writes and restores
• Static files served from an explicit allow-list
• Content-Security-Policy with no inline script or style
• Every mutation written to the audit trail