Request and response integrity
Desktop requests use Ed25519 device signatures over canonical metadata and an exact body hash. Timestamp and nonce checks reject stale or reused requests. Responses are signed against the originating request ID and exact returned body so clients can pin and verify the service decision.
Short-lived, revocable sessions
Access credentials expire quickly, refresh values rotate, and server-side session state can be revoked. License revocation closes dependent sessions, refresh families, device bindings, step-up access, and pending download tickets.
Sensitive storage
Browser session nonces, refresh credentials, trace tokens, and unused license lookup values are stored as one-way hashes or protected ciphertext as appropriate. Private device keys remain on the client. Production secrets and the SQLite database live outside the release document root.
Operational controls
Administrative and customer surfaces use same-origin checks, CSRF controls, bounded input, security headers, and account-scoped data access. Rate limits apply to both network and identity dimensions. Security telemetry is bounded and excludes credentials and private keys.