Account and security - Password hashing: argon2id. - 2FA: TOTP-based, enable from Dashboard > Settings. - Sessions: view and revoke active sessions. - CSRF: every state-changing request is protected. - Audit log: admin actions are recorded.