Security

• Headers: strict nonce-based Content-Security-Policy, HSTS, X-Frame-Options: DENY, nosniff and a locked-down Permissions-Policy.
• Abuse: rate limits on every sensitive route; account, IP and device bans (banning a member blocks every IP and browser they used); disposable-email blocking.
• Bots: invisible reCAPTCHA v3, with the v2 checkbox only as a step-up when v3 is unsure.
• Accounts: Argon2id password hashing, optional emailed two-step codes for customers, TOTP with recovery codes for staff, admin roles enforced per route.
• Tickets and payments: HMAC-signed ticket QR codes, signed payment callbacks, idempotent checkout.
• Uploads: profile and review photos are re-encoded with location data stripped.
• Usher assistant: no free-text input; its data endpoint takes no input, is rate limited and returns personal data only to the signed-in owner with no-store.

Reporting a vulnerability

Please report privately through GitHub security advisories, as described in SECURITY.md. Don't open a public issue.

Further reading: One seat, two buyers: race conditions, IDOR and keys in BookMyMovie.