Security

• Passwords are stored as scrypt hashes with per-user salt; only SHA-256 digests of session tokens are stored. Sessions use an HttpOnly, SameSite=Strict cookie and expire after 7 days of inactivity.
• Five failed logins from one address within five minutes block further attempts for a while.
• Roles are enforced by the API, not only hidden in the UI.
• The web interface is HTTPS-only (TLS 1.2+). Plain http:// on the same port is redirected to https://, and the session cookie is marked Secure. The installer creates a self-signed certificate (ECDSA P-256, valid 825 days, all host addresses in SAN) and renews it on upgrade when it expires within 30 days. Browsers warn about self-signed certificates once — compare the SHA-256 fingerprint the installer prints. To use your own certificate, place it at /etc/flowsphera/tls/cert.pem and key.pem (readable by group flowsphera) and restart flowsphera-web; the installer keeps it. FT_TLS=no at install time keeps plain HTTP (e.g. behind a TLS reverse proxy — then set X-Forwarded-Proto: https there).
• The Telegram bot token and the SMTP password are kept in /var/lib/flowsphera/notify.json (readable by the service only), never sent to the browser and never written to the log.
• ClickHouse listens on 127.0.0.1 only; user filters reach it as bound query parameters.
• Services run as the unprivileged flowsphera user with a read-only system (ProtectSystem=strict); users, sessions and devices added from the UI are stored in /var/lib/flowsphera.

API tokens and webhooks (1.11.0)

• API tokens (ftapi_…, 256 random bits) are stored only as SHA-256 in /var/lib/flowsphera/api_tokens.json (0600) and shown once. They never manage users, tokens or the license, nor delete backups; a Read only token changes nothing. Wrong tokens share the failed-login limit of the address (5 in 5 minutes). Revoke a leaked one in Settings → API: it stops working at once.
• Webhook secrets and extra headers stay in notify.json (0600), are never sent to the browser or the log; with a secret each request is signed (HMAC-SHA256 over the timestamp and the body).

Sign-in through Active Directory / LDAP (1.12.0)

• The sign-in page offers «Local account» or the directory; nothing is guessed from the name. Directory users are kept as ldap:<name> without a password; their role comes from their groups at every sign-in and their sessions end after 12 hours (no sliding), so someone removed from a group loses access within that time at the latest.
• FlowSphera binds with a service account to find the user (the typed name is escaped and restricted to letters, digits and . _ @ -, so it cannot change the LDAP filter), then binds as the user to check the password. Use LDAPS or STARTTLS with "Verify the certificate" (paste the directory's CA if it is not a public one); the service account only needs read access. Its password is stored in /var/lib/flowsphera/ldap.json (0600) and never sent to the browser.
• Wrong directory passwords count with the failed logins of the address. At least one local administrator always remains, so a broken or unreachable directory never locks you out. API tokens cannot change these settings.