Security
Security
Login sessions use signed cookies and production environments must use strong random secrets.
Stripe, HubSpot, Twilio, and speech-service keys should only be stored in server environment variables.
If you find a security issue, submit it through the contact page with Security in the subject.