Security and backups

Signing in

Passwords need at least 12 characters and are stored with Argon2. Repeated failed sign-ins from one address are slowed down. Anyone can turn on two-step sign-in with an authenticator app, and gets recovery codes for a lost phone. A super user can require it for everyone.

Under your account you can see every signed-in session, with its browser and address, and end any of them.

The audit log

Every change by a person, a command or an AI agent is written to the audit log with who made it and when. Agent changes are marked with the tool they used.

Backups

Back up now in the admin, or sophia backup, writes one zip with a consistent copy of the database, every site's pictures, installed extensions, trusted keys and settings. Published releases are left out, because publishing rebuilds them. Fourteen backups are kept by default.

To restore, unpack a backup into an empty folder with sophia restore <file> --into <folder>, then start the program with --data <folder>.

The install checklist

This install > Security lists what still needs doing before a site is public: HTTPS cookies, developer mode off, public addresses set, a mail server, two-step sign-in for every admin, and a recent backup.

How it is built to be safe

• Visitors get published files by default, so most of the site is plain files with nothing to attack.
• On a server, the program runs as its own account in a systemd sandbox, can write only its data folder, and listens only on 127.0.0.1 behind your web server.
• Extension code runs in a sandbox and gets only the permissions its manifest declares and the site allows.
• Every form is checked against its schema, and every admin form against a per-session token.
• Packages install only when a trusted key signed them, and program updates only when the SOPHIA XT release key signed them.