Security and privacy

Stored secrets

Pushover credentials are encrypted with the configured Anchor data-encryption key. Session tokens, API-key secrets, and occurrence response tokens are stored as hashes rather than recoverable plaintext.

Browser security

Browser sessions use secure cookies in production. State-changing session requests require CSRF protection, and sensitive account operations require recent authentication.

Response-link secrets stay out of ordinary request URLs, browser storage, analytics, and application logs.

Operational responsibility

Production operators must protect encryption keys, database backups, OAuth credentials, email-provider credentials, and API-key hash peppers. Rotate compromised credentials and revoke affected sessions or API keys.