WapveHardened sessions
Random opaque session secrets stay in HttpOnly cookies; only their hashes are stored in the database.
A secure foundation from day one.
No software can promise it will “never be hacked.” Wapve uses layered controls to reduce risk and detect problems early.
Modern password protection
Passwords use Argon2id, weak choices are rejected and resets revoke active sessions.
Request protection
Mutations require CSRF and Origin checks; sensitive endpoints use IP and account rate limits.
Safer uploads
Uploads are inspected beyond extensions using content and magic-byte validation, then images are re-encoded.
Least privilege
Unverified accounts are restricted and ownership or membership is checked server-side on every request.
Continuous checks
Linting, types, unit and end-to-end tests, dependency audits and secret scans form the quality gate.
Found a security issue?
A public reporting channel will be announced before production launch. Until then, Wapve remains a private alpha.