Security & hardening
How we protect accounts and how we treat the keys you publish.
Authentication
- Passwords hashed with Argon2id (memory-hard, side-channel resistant).
- Session tokens are 256-bit random values, hashed at rest. Cookies are HttpOnly, SameSite=Lax, Secure in production.
- Optional TOTP MFA with hashed recovery codes.
- Step-up auth required for sensitive actions (key revocation, email change).
Tokens & secrets
- Email verification, password reset, and API tokens are stored as SHA-256 hashes.
- Secrets are shown once at creation; never recoverable.
- Generic responses to enumeration attempts; rate limits on auth endpoints.
Public keys
- Uploaded key material is treated as untrusted input and validated before storage.
- Identification is always by full fingerprint — never short IDs, comments, or UIDs.
- Lifecycle events (revocation, supersession, expiry) are preserved as a public timeline.
Disclosure
Email security@pubid.io with vulnerabilities. We acknowledge within 72 hours.