Security

Raypx provides typed APIs, auth flows, admin surfaces, and database patterns, but each deployment operator is responsible for production hardening.

Operators should configure secrets, database access, email providers, storage providers, and analytics settings for their own environment.

The app uses Better Auth for sessions and account flows. Dashboard routes enforce authenticated access, and admin routes enforce role checks.

Production deployments should use HTTPS, rotate secrets, and restrict administrative access to trusted accounts.

For upstream security concerns, open a private disclosure or maintainer contact through the Raypx repository if available.

For a third-party deployment, contact that deployment operator because they control the runtime, data, and infrastructure.