Security
A specific, honest description of what's actually implemented — not a generic list of buzzwords.
🔒 Passwords
Hashed with PHP's password_hash() (bcrypt), never stored or logged in plain text. Password reset links are single-use, hashed at rest, and expire after one hour.
🛡️ Sessions
httponly and SameSite=Lax cookies, with the session id regenerated on every login to prevent session fixation.
✅ CSRF protection
Every state-changing form (login, registration, form submissions, settings) carries a session-bound token that's verified before anything is processed.
📄 Form submissions
Every field is validated server-side regardless of what the browser already checked. Submitted text is sanitized against stored XSS; option-based fields reject values outside what you actually configured.
📎 File uploads
Executable file types are always blocked, regardless of a form's configuration. Uploaded files are renamed to a random name, their real content is verified against the claimed file type, and the upload folder is configured to never execute scripts.
🚦 Rate limiting
Login, registration, password resets, form submissions, and AI generation are all rate-limited per IP address to slow down brute-force and spam attempts.
Database access
All database queries use prepared statements via PHP's PDO — no query is ever built by concatenating user input into SQL.
Reporting a security issue
If you find a security issue, please email Form@lumara.chat with details rather than filing a public report.