Reference
Security
What MakeV1 does for you, and the rules to keep when you extend it.
Built in
- Sessions only in HttpOnly cookies; session tokens and saved SSO secrets are removed from every response
- Every query scoped to the caller's organization; foreign ids answer 404
- Requests to user-supplied URLs checked against private networks, again at connect time, so DNS rebinding fails
- Provider secrets and SSO keys encrypted at rest
- Revocations, bans and role changes take effect on the next request
- Admin tools need a second factor
- Webhooks verified, applied once and in order
- Public forms rate limited by a keyed hash of the address, never the address itself
- Nothing optional runs before cookie consent
Rules when you extend it
- Build routes with
route({ access }); list every public route with a reason. - Filter every query by organization.
- Never log, enqueue or return a secret.
- Fetch user-supplied URLs only through
safeFetch. - Load trackers only through the consent module.