Security is part of the workflow.

AtlasOps includes application-level controls for authentication, sessions, roles, API keys, secrets, audit history, and webhook verification.

Authentication and sessions

Authentication uses a credentials provider with explicit validation and server-side password checks.

Passwords are hashed with bcrypt before storage and never returned to client components.
NextAuth credentials callbacks are CSRF protected and use signed JWT sessions.
Remembered sessions are recorded in UserSession rows for audit and revocation workflows.
Password reset and email verification tokens are hashed before storage and marked used after successful completion.

Every sensitive action should be scoped through the authenticated organization membership.

Users have platform-level roles and organization-member roles.
Organization owners can manage billing, members, teams, and settings for their workspace.
Server Actions re-read ownership from the authenticated session instead of trusting client-supplied IDs.
Audit logs preserve actor, action, entity, organization, and timestamp context for sensitive operations.

The Next.js proxy applies baseline security headers before requests reach pages or route handlers.

Content-Security-Policy
X-Frame-Options
X-Content-Type-Options
Referrer-Policy
Permissions-Policy

External credentials should be stored and rotated with the same discipline as infrastructure secrets.

API keys are stored as hashed digests with prefixes for display.
Webhook secrets are stored as digests and Razorpay payloads are verified with HMAC signatures when configured.
SSH keys and environment variables are tied to organizations, projects, and environments.
Secrets should be rotated after team changes, suspected exposure, or provider-side credential resets.

Authentication and sessions

Authentication uses a credentials provider with explicit validation and server-side password checks.

Passwords are hashed with bcrypt before storage and never returned to client components.
NextAuth credentials callbacks are CSRF protected and use signed JWT sessions.
Remembered sessions are recorded in UserSession rows for audit and revocation workflows.
Password reset and email verification tokens are hashed before storage and marked used after successful completion.

Authorization and ownership

Every sensitive action should be scoped through the authenticated organization membership.

Users have platform-level roles and organization-member roles.
Organization owners can manage billing, members, teams, and settings for their workspace.
Server Actions re-read ownership from the authenticated session instead of trusting client-supplied IDs.
Audit logs preserve actor, action, entity, organization, and timestamp context for sensitive operations.

Secrets and webhooks

External credentials should be stored and rotated with the same discipline as infrastructure secrets.

API keys are stored as hashed digests with prefixes for display.
Webhook secrets are stored as digests and Razorpay payloads are verified with HMAC signatures when configured.
SSH keys and environment variables are tied to organizations, projects, and environments.
Secrets should be rotated after team changes, suspected exposure, or provider-side credential resets.