Security

Passwords are hashed with PBKDF2-SHA256, a unique random salt per user, and 100,000 iterations, the maximum the Cloudflare Workers runtime supports. We never store or log plaintext passwords.

Signing in issues an opaque session token stored server-side in Cloudflare KV with an expiry, the token itself carries no readable account data, so it can't be decoded or tampered with client-side. The session cookie is HttpOnly, Secure, and SameSite=Lax.

All traffic to CoFusion is served over HTTPS via Cloudflare.

We're early-access and transparent about what's not built yet: there's no rate limiting on login, signup, or AI endpoints; no two-factor authentication; and we haven't had a formal third-party security audit. We're noting these honestly rather than implying protections that don't exist.

If you find a security issue, please contact us directly rather than disclosing it publicly.