Docs

Security

What we actually do, without the fog.

• Sign-in is a single-use link. There is no account password to steal.
• Session and CSRF cookies use the __Host- prefix on HTTPS: Secure, Path=/, no Domain attribute.
• Mutations require a same-origin request and a CSRF token.
• File bytes are served only from the download host, with Content-Disposition: attachment and nosniff.
• Link passwords are stored as PBKDF2-SHA-256 hashes.
• Dodo webhooks are verified with the Standard Webhooks signature, a 5-minute timestamp window, and a constant-time compare. The webhook-id is stored so retries do not apply twice.
• Quotas are reserved with a single conditional database update.
• An operator kill switch can disable the service, one workspace, one delivery, or one request.