Security
TimeMachineOnline uses session authentication, password hashing, tenant-scoped database access, security headers, audit logging, and server-side subscription enforcement.
Production operators must set a strong session secret, configure Stripe and email credentials, rotate default or weak credentials, enable monitoring, and run backup restore drills before public launch.
Report suspected security issues through the support channel for this deployment.