Security

• Login: GitHub App OAuth with PKCE and a single-use state. Only people with write access to the site repository can log in; it's confirmed with GitHub at login and about once an hour.
• Sessions: an encrypted, HttpOnly, Secure, SameSite=Lax __Host- cookie that refers to a server-side session in KV. Idle and absolute timeouts; logout deletes the session server-side.
• Tokens: GitHub tokens never reach the browser. They are stored encrypted (AES-GCM) in KV and refreshed before expiry.
• Browser: a strict Content-Security-Policy (no inline or third-party scripts, no eval; WebAssembly is allowed only for the bundled WebP encoder, needed because iOS browsers can't encode WebP), CSRF protection on every state-changing request, HSTS and other security headers. No analytics or trackers. Before signing in, the address that was opened is kept in the tab's session storage, to open it again afterwards; only a path of the app itself is accepted (never another site, the sign-in or the API routes).
• Data: drafts, archived items and the Bin are folders of the site repository (drafts/, archive/, bin/; keep it private). The app deletes posts, pages and drafts from the repository only when the Bin is emptied; the one other deletion is a category's term page, when the category is deleted in Categories (after a confirmation that names how many posts use it), or moved to its new folder when its address changes. Images never go into git: draft images are in a private R2 bucket, published images in your public bucket, where the app never overwrites anything. A published image leaves it only when it's deleted in Media (orphaned images only): it moves to the Bin, in the private bucket under media-bin/, and is deleted only when the Bin is emptied.
• Logs contain request IDs, routes, status codes and GitHub user IDs only.

Secrets are rotated by hand when Alasin reminds you: see Housekeeping.

Report vulnerabilities as described in SECURITY.md, not in public issues.