Security — Signing in (3)

• Secrets at rest: Two-factor seeds and connected-app OAuth tokens are encrypted in the database, not merely stored in it. A dump of the tables does not yield working authenticator secrets or usable third-party tokens. • Session cookies: HttpOnly and SameSite-restricted, marked secure, and served over HTTPS with HSTS in production. • Brute-force resistance: Two layers. Authentication endpoints are rate-limited per source address, and each account separately counts consecutive failures, locking for 15 minutes after 10. The per-account counter is the one that matters against credential stuffing, where attempts arrive from many addresses at once. • Enforced two-factor: The owner of a workspace can require two-factor of everyone in it. People without it are sent to set it up before they can continue, and the requirement applies to members invited later.