Argon2id password hashing with a unique salt for every password.
HttpOnly, SameSite session cookies; no authentication token in browser storage.
Session tokens stored only as SHA-256 hashes.
CSRF protection and same-origin checks for state-changing requests.
Per-user authorization on every profile and VIN query.
Parameterized database statements and strict request validation.
Rate limits and temporary account lock after repeated sign-in failures.
Security headers including Content Security Policy and framing protection.