Opaque server sessions
Session secrets are stored as hashes in PostgreSQL and delivered through HttpOnly cookies.
Hexa Shield
Web Security
Visitor
Security & trust
Security claims should bespecific and verifiable.
Hexa Shield focuses on application-layer filtering, abuse controls, tenant isolation, secure account access, and operational visibility. It does not claim perfect security or unlimited volumetric DDoS absorption.
Hashed API credentials
API-key secrets are shown once and only the hash plus a display prefix are stored afterward.
Tenant isolation
Domain, rule, DNS, analytics, and security-event handlers resolve resources through the authenticated owner.
Sensitive data redaction
Security-event storage avoids retaining sensitive request headers in plain form.
Built-in controls
- • Account lockout after repeated failed login attempts.
- • Email verification for password-based account activation.
- • Discord OAuth with verified-email requirement.
- • Admin role enforcement on the server, not just in navigation.
- • SSRF checks on customer-configured origin hosts.
- • CORS restricted to the configured dashboard origin.
Honest boundaries
- • No built-in multi-factor authentication yet.
- • Bot classification is heuristic, not a guaranteed identity signal.
- • Recent live analytics are limited to the implemented Redis retention window.
- • A single deployment is not a global anycast volumetric scrubbing network.
- • Origin TLS certificate validation remains a documented deployment limitation.