Security

We protect accounts and tokens with session controls, secure sign-in, and server-side validation for protected operations.

Admin routes are restricted by server middleware and account role checks. User sessions are scoped and validated before watch/admin operations.

If you detect unauthorized behavior, rotate access paths immediately and contact support with timestamps, session details, and affected user identifiers.

Some security controls are environment-dependent (for example IP allowlist and callback endpoints) and may differ between local, staging, and production.