Argon2id passwords
Passwords are hashed, never stored in plaintext.
Security
Security is part of the platform architecture, not a launch-day patch.
Part 1 established separate user and administrator authentication boundaries. Part 2 exposes account security transparently to users.
Server-side sessions
Opaque session tokens are hashed in storage and can be revoked per device.
Verified user workspace
Protected BTT workspace endpoints require an active account and verified email address.
Separated administrator boundary
Admin users and sessions use separate data models, cookies, guards and routes.
Mandatory admin 2FA
Administrator access requires TOTP after password authentication, with one-use recovery codes.
Audit trail
Sensitive admin authentication and security actions are recorded for review.
Origin protection
Cookie-authenticated mutating requests are protected against untrusted browser origins.
Evidence integrity ready
The evidence model includes hashes and source metadata for later capture workflows.