Data

An account stores a name, a password hash, sessions, and whatever you put on the profile: display name, text, color, links, avatar, and banner. A follow is a public link between two accounts. Follower and following counts are public. Email is not used to log in. An API key is stored as a hash. The secret does not stay on the server. Mod files are stored by sha256. The audit log records who created a page, a key, or a revocation.

Login, registration, and site uploads go through Cloudflare Turnstile. The IP is used for limits. Behind your own proxy, TRUST_PROXY trusts only private-network addresses.

Avatars and banners are PNG, JPEG, GIF, or WebP. Profile links are https only. The profile page is public at /u/name. A published mod page can also show up to six screenshots and one short video. Use your own Turnstile keys before a public domain.