Security
Security that matches the product.
FixTray ships practical, verifiable safeguards in the codebase today - authentication, authorization, CSRF protection, rate limiting, and input validation.
Role-based access
API endpoints enforce roles with requireAuth and requireRole.
JWT authentication
Access tokens are verified on protected routes.
Password hashing
User passwords are hashed with bcrypt.
CSRF protection
State-changing requests use CSRF tokens and double-submit validation.
Rate limiting
Auth and API routes apply request throttling.
Input validation
Requests are validated and sanitized before persistence.
Audit logging
Admin activity logs are recorded and retrievable via API.