Security

APRI-HUB now implements closed operational onboarding, Argon2id credentials, short-lived access tokens, rotating refresh families, TOTP MFA, server-tracked sessions, scoped authorization, classification enforcement, redacted logs, and append-oriented events.

Authentication states

Unauthenticated, forbidden, suspended, MFA-required, session-expired, and reauthentication-required states are distinct. TOTP improves security but is not described as phishing-resistant; the model reserves WebAuthn as a future method.

Do not share sensitive operational information through public pages or unsolicited channels.