Secure by default, auditable by design

The controls you would otherwise add the week before launch are already on. What is left is your own business logic.

Built for production, not just for the demo

These defaults are exactly the ones you would otherwise have to add before going live.

Secure by default
Credential hashing, HTTP-only cookies, CSRF protection and hardened response headers are on before your first commit.
Access control on both ends
Role-based route protection runs on the server and the client, so a missed check never silently exposes a page.
Signed project traffic
Every call between Console and project is HMAC-signed with replay protection and per-environment credentials.
Audit everything
Content, configuration and permission changes are recorded with actor, time and diff.
Encrypted secrets at rest
Integration credentials and provider keys are stored encrypted; the database never holds plaintext.
Environment isolation
Test and production have separate credentials, snapshots and route registries. Promotion is explicit.

1
Draft
Edits stay in the draft slot. Nothing public changes.
2
Publish to test
The release gate validates structure, locales, paths and dependencies before the test snapshot is written.
3
Promote to production
The same fingerprinted release is promoted. No re-edit, no surprises.

Where do secrets live?+

Encrypted in the database with a key that only the runtime holds. Rotation is a configuration change, not a migration.

Can a compromised editor account change production?+

Only through the publish gate, which is role-checked and audited. Production promotion can be restricted to a separate role.

Do you support SSO?+

Yes. Console sessions can be bridged into the project admin with short-lived, single-use tokens.