Security

A specific, honest description of what's actually implemented — not a generic list of buzzwords.

🔒 Passwords

Hashed with PHP's password_hash() (bcrypt), never stored or logged in plain text. Password reset links are single-use, hashed at rest, and expire after one hour.

🛡️ Sessions

httponly and SameSite=Lax cookies, with the session id regenerated on every login to prevent session fixation.

✅ CSRF protection

Every state-changing form (login, registration, form submissions, settings) carries a session-bound token that's verified before anything is processed.

📄 Form submissions

Every field is validated server-side regardless of what the browser already checked. Submitted text is sanitized against stored XSS; option-based fields reject values outside what you actually configured.

📎 File uploads

Executable file types are always blocked, regardless of a form's configuration. Uploaded files are renamed to a random name, their real content is verified against the claimed file type, and the upload folder is configured to never execute scripts.

🚦 Rate limiting

Login, registration, password resets, form submissions, and AI generation are all rate-limited per IP address to slow down brute-force and spam attempts.

Database access

All database queries use prepared statements via PHP's PDO — no query is ever built by concatenating user input into SQL.

Reporting a security issue

If you find a security issue, please email Form@lumara.chat with details rather than filing a public report.