The backend uses session-based authentication with opaque access and refresh tokens.

Passwords are hashed with argon2id.

Database tokens are encrypted with MASTER_KEY using AES-256-GCM.

• rate limiting
• Helmet security headers
• CORS restriction through configuration
• audit logging for sensitive operations

• never commit secrets to the repository
• rotate MASTER_KEY carefully because it affects token decryption
• back up the control-plane database and managed SQLite files separately
• use the audit log for user and database operations

The backend only manages databases that are explicitly created, imported, discovered from a mounted path or registered by URL and token.

It does not infer credentials from arbitrary servers.