Sign-in
Passwords are hashed with argon2id. A login creates a server-side session. The browser holds only an HttpOnly cookie, marked Secure in production. Logging out deletes the session, so access ends immediately. A password change does the same.
Security
Bright pages. Careful locks.
Opravis is a working system for plans, owners, and dates. The protections below are how the application is built. This page does not claim a certification, a penetration-test badge, or a specific uptime figure.
Forged requests
Unsafe requests must echo a CSRF token. Public form submission is the exception, because it is not signed in with that cookie, and it is rate limited.
Separate workspaces
The active workspace comes from the session. A person cannot point the request at another organization's identifier and read it. One installation can host many workspaces. They stay apart on every request.
Roles that the server checks
Organization admins run the workspace. Project owners, editors, and viewers are enforced in the service layer, not only by hiding buttons. A viewer cannot comment or edit by calling the API. Records they must not know about answer as not found.
Reports match the person
Dashboards and reports store a definition. Results are computed with the viewer's own permissions, so a shared board cannot leak a project that person cannot open.
A record of change
Organization plans include an audit log. Unexpected errors return a request id, not a stack trace. Rate limits live in the database so they hold across processes. Knowledge items are visible only to their owner.
What this page leaves out on purpose
- There is no published single sign-on offering. The account model can accept an external identity later. That is not the same as having it now.
- Backups and the host's disk encryption are duties of the installation. Ask about them when you request an evaluation.
- People are invited with a one-time link. There is no shared default password.
Password reset uses a single-use, expiring token when email is configured. An administrator can also hand over a one-time link.