Security & 2FA

Passwords are stored with Argon2id and a configurable policy. Each user can enable two-factor authentication (2FA TOTP), made mandatory per role if desired, and mechanics can sign in with a quick PIN on the workshop tablet registered as a bay.

It includes progressive lockout by attempts, IP rate limiting, an optional allowlist, session timeout on inactivity, visible and revocable active sessions, CSRF protection on every form and security headers (CSP, HSTS, X-Frame-Options). Secrets (certificates, keys) are stored encrypted.

What it includes

• Argon2id passwords and configurable policy
• Two-factor authentication (2FA TOTP)
• Bay PIN for mechanics on the tablet
• Lockout by attempts, IP allowlist and revocable sessions
• CSRF, security headers and encrypted secrets