Security and Privacy

Kinoder uses opaque cookie sessions, Argon2id password hashing, encrypted retained credentials, backend authorization, private object storage, signed media access, and immutable audit events.

Security boundaries

• Session values are stored as hashes and sent through HTTP-only cookies.
• MFA secrets and retained provider credentials are encrypted at rest.
• The backend enforces workspace isolation.
• Media remains private unless an explicit expiring delivery route is issued.
• Project manifests store stable asset IDs instead of public or temporary URLs.
• Accepted paid jobs snapshot route, price, timeout, and resolved settings.
• Public Pages accept constrained widgets rather than executable code.
• MCP access is scoped, role-checked, revocable, and audited.

IMAGE PLACEHOLDER - Security boundary Replace with a trust-boundary diagram for public browser, authenticated app, API, private storage, worker, and external providers. Recommended size: 1800 x 1100 px.

Operators remain responsible for TLS, secrets, backups, patching, ingress controls, least privilege, monitoring, and incident response.