Security

Security that is restrained, explainable and testable

DimaReady favors least privilege, a small dependency surface and claims limited to what is actually implemented and verified.

Hardened server sessions, CSRF protection, rate limiting and role separation.

Account and security-event management remains separate from decrypted health data.

Restrictive CSP, input validation and private storage outside direct Web access.

The vault separates account authentication from the secret used to unlock sensitive records.

Report a security issue

The technical reporting channel is documented in security.txt.