Build log entry
Locking the doors
Vahid AslaniA security pass before going live. Browsers now talk only to Axiean's own web server, which relays their requests to the API over a private network; the API refuses anyone else. Sign-in tokens live in cookies that page scripts can't read, and every change is checked against cross-site request forgery twice. Sign-in attempts are limited per account, but your own browsers keep their own allowance, so someone hammering your account can't lock you out. Password-reset and verification emails are limited too, and nothing in the timing of an answer reveals whether an email has an account.
