Built secure by default
Defense-in-depth architecture with automated enforcement. Every request verified at multiple layers. Build fails if security is missing.
Architecture
Three layers of protection
Every request passes through multiple security checks. If one layer is bypassed, the others catch it.
Network Layer - CSRF Protection
Cross-site request forgery prevention at the network edge. Validates Origin and Referer headers for all state-changing requests.
Page Layer - Automatic Authentication
All pages in protected route groups automatically require authentication. New pages are secure by default - you can't forget to protect them.
API Layer - Enforced Wrappers
Every API endpoint must use authentication wrappers. Build fails if any endpoint lacks protection - no silent failures.
Enforcement
No silent failures
Security isn't a checklist - it's automated and enforced at build time. Mistakes are caught in CI, not production.
Automated Security Scanner
Runs on every test and CI build. Verifies all API routes are protected. Build fails with clear error if protection is missing.
Zero-Trust Architecture
Every request is verified at multiple layers. No assumptions. No shortcuts. Sessions validated against database on every request.
Secure-by-Default Pages
Route groups enforce authentication automatically. Protected pages can't accidentally become public - it's impossible by design.
Features
Complete security coverage
From authentication to data protection, every aspect is designed with security first.
Authentication
- Email verification on signup
- Optional Two-Factor Authentication (TOTP)
- Trusted device support (30-day remember)
- Session management with device tracking
- Password breach checking via HaveIBeenPwned
Session Security
- Database-backed session validation
- Real-time session invalidation
- Device fingerprinting
- Automatic session expiration
- Manual session revocation
Access Control
- Role-based permissions (Owner, Member, Viewer)
- Company-level tenant isolation
- Per-request authorization checks
- Rate limiting on sensitive endpoints
- Activity logging for security audit
Data Protection
- Encrypted data in transit (TLS)
- Secure password hashing (bcrypt)
- CSRF token validation
- Input validation and sanitization
- SQL injection prevention (parameterized queries)
Why This Matters
Security without compromise
Can't forget protection
New pages are automatically protected unless explicitly marked public. Protected API routes are enforced at build time. You literally cannot ship unprotected code.
Scales with your team
Whether you're a solo developer or managing a team of contributors, security is enforced automatically. New team members can't accidentally expose data - the build simply won't pass.
Enterprise without complexity
You get security that rivals products 10x the price, without the complexity. No security training required. No manual checklists. Just automated protection that works.
Ready to manage work without managing the tool?
Three columns. One workflow. Start in minutes.
No credit card required · Free to start, upgrade when your team grows