Security practices for ForeverLink workspaces and public redirects.
Argon2id/bcrypt password hashing, mandatory TOTP 2FA, single-use recovery codes, progressive lockouts after failed logins.
HttpOnly cookies, SameSite=Strict, Secure in production, inactivity timeout, session regeneration after login.
CSRF tokens on POST forms, prepared statements, tenant-scoped queries, security headers on admin surfaces.
Only http/https destinations accepted. Dangerous schemes are rejected at write time.
Responsible disclosure via our contact form — please include steps to reproduce.
Contact security