Security

What the application does on its own, what the owner can switch on, and how to get back in when something locks you out.

Built in

Every form carries a CSRF token; every staff page sits behind a permission; clients only ever see their own records.
Sign-in, password reset and two-factor pages are rate limited. Failed client sign-ins from an unknown browser lock the account temporarily; a browser that has signed in successfully is remembered by the twerplex_client_device cookie and is not locked out by attempts from elsewhere.
Passwords are hashed with bcrypt. API keys, gateway secrets, panel tokens and other credentials are stored encrypted and shown only once.
Uploaded images are re-encoded (which strips metadata and anything hidden in them) and stored under random names; SVG uploads are not accepted. Nothing in public/uploads/ or public/extensions/ is executed as a script.
Security headers and a content security policy are sent with every page.
Every privileged action is written to an append-only audit log (System → Audit log).
Outgoing HTTP goes only to the services you configured and to the update and licence services, always with timeouts.

Settings for the owner

System → Settings → Security:

Two-factor authentication. Staff turn it on for themselves under their account; the owner can require it for everyone, after which staff without it are asked to set it up before they can continue.
Sessions. Staff session lifetime and whether "Keep me signed in" is offered.
Staff area IP allowlist. Only the listed IPv4 or IPv6 addresses and ranges can reach the staff area and its sign-in page.
Trusted proxies. Only for sites behind a load balancer or a CDN such as Cloudflare: the proxy addresses whose forwarded headers are believed. Without this, every visitor would appear to come from the proxy.
HSTS for sub-domains and how long the audit log is kept.

Access review

System → Staff → Access review lists every staff member with their role, sensitive permissions, last sign-in and two-factor state, API tokens with their last use, and accounts or tokens that have been idle for a long time, so the list can be trimmed. The review can be exported as CSV.

Recovery commands

For the cases where the settings above lock out the only person who can change them:

php artisan staff:clear-ip-allowlist          # remove every entry from the IP allowlist
php artisan staff:reset-two-factor you@example.com   # switch off 2FA for one staff member
php artisan extensions:disable <slug>         # switch one extension off without loading it
php artisan extensions:disable --all          # switch every extension off

Creating the file storage/app/extensions.safe puts the application in safe mode: no extension is loaded at all until the file is removed. Use it when an extension breaks the site.

Cookies

Cookie	Purpose
session cookie (name derived from the installation)	The signed-in session for staff and clients. Encrypted, HTTP-only, secure on HTTPS.
`XSRF-TOKEN`	The CSRF token for forms and the client-side scripts.
`twerplex_client_device`	Marks a browser that has signed in to the client area successfully.
`twerplex_update`, `twerplex_restore`	Let the owner keep access while an update or a restore runs in maintenance mode. Removed when it ends.

Files to protect

.env holds the application key and the database password. The installer's last page checks that your server does not serve it; keep it out of version control and out of backups you hand to others.
storage/ and bootstrap/cache/ must be writable by the web server but never reachable from the web. The shipped .htaccess files and the nginx rules in Installation take care of that.