Security

Encrypted transport, HSTS, and secure headers.
Server-side validation and sanitization for all inputs.
No client-side secrets; Cloudflare env bindings only.
Right to erasure supported on verified request.