Everything you need for Never Trust.
Authentication for every client, authorization down to the record, a full defensive pipeline, and ready-made account, user and admin workflows — all failing closed by default.
New for 2026 — five extension tracks carry the Never Trust pipeline forward: RFC 9421 signatures, FIDO2 passkeys, AuthZEN / OpenFGA authorization, an adaptive identity firewall, and policy-driven suspension with CAE. See Security Extensions →
A comprehensive, multi-stage pipeline.
Every request runs the full gauntlet, with events, hooks and settings to alter built-in stages or inject your own.
Cross-site scripting (XSS)
Detect and resist XSS injection and sanitize untrusted data wherever it lands — in emails, API payloads and both front-end and back-end rendering. Encoding is applied for the output context, so a value meant as text is never parsed as markup.
Read the whitepaper →Authentication
Securely connect browsers, mobile apps, IoT devices, background jobs and third parties through one pipeline that supports multiple schemes and identity types — so every caller is verified the same way, whatever it is.
Read the whitepaper →IP firewall
Restrict access to trusted networks or machines, applied equally to API keys and high-privileged user sessions. Bind sensitive credentials to known address ranges so a leaked key is useless from anywhere else.
Read the whitepaper →Multi-factor (MFA)
Enforce multi-factor verification as policy rather than per-controller code, then selectively exempt specific users, operations or trusted networks. The second factor is required where the risk is and out of the way where it is not.
Read the whitepaper →User account verification
Limit what an account can do until its email or mobile number is verified, backed by an end-to-end verification workflow. Chosen operations can be exempted so onboarding is never fully blocked.
Read the whitepaper →Activity-data authorization (ADA)
Authorize not just the action but the specific data it touches, down to individual records and fields. Conventions derive permission codes and flag sensitive fields automatically, so authorization stays consistent without hand-written checks in every handler.
Read the whitepaper →Suspension
Suspend a whole user, or a single operation on a single entity such as an account or contact, in response to KYC, fraud or OFAC signals — while still permitting chosen operations. Revocation takes effect immediately, with no deployment required.
Read the whitepaper →A scheme for every integration.
Different schemes and identities support every client and server-to-server scenario.
HMAC
Every request carries a keyed HMAC signature over its canonical form, with a timestamp expiry window and nonce-based replay prevention. The signature proves both the caller’s identity and that the payload arrived untampered.
Read the whitepaper →Service-HMAC
Machine-to-machine HMAC that can be bound to specific values — a particular record id, say — and carries its own expiry. A signed service call is scoped to exactly the operation and object it was issued for.
Read the whitepaper →Service-Key
Scoped API keys that grant an integration only the endpoints it actually needs and nothing more. Least privilege at the credential level keeps a compromised key’s blast radius small.
Read the whitepaper →AuthCookie
Browser-session authentication with sensitive-key protection and origin restriction, so the session cookie is hardened against theft and cross-site reuse and kept out of JavaScript’s reach.
Read the whitepaper →Identities
Site-to-site keys, feature keys and user sessions are all first-class identities, each authenticated and authorized through the same pipeline — one model for humans and machines, with no second, weaker path for service traffic.
Read the whitepaper →Replay & tamper protection
Request integrity checks and short expiration windows defeat replayed or tampered calls: a captured request cannot be resent, and any change to its contents invalidates the signature.
Read the whitepaper →Activity-based, data-aware authorization.
ADA is a unique access-control mechanism giving you convention-based, granular control over what operations a caller can execute and on what data. It automatically determines permission codes and discovers sensitive data fields in requests — with options to override every default.
- Permit per action by default — no permit, no access.
- Authorize the specific record referenced in the request.
- Convention-driven, with little to no application code.
- Override conventions per action where you need to.
Common workflows, as source — no code required.
Cut secure-build time by ~20%. Get production-ready implementations you own and extend.
Account management
A complete account lifecycle out of the box — registration, login, two-factor, forgot-password, account settings, IP-firewall management and email verification — so the security-sensitive flows ship with the framework instead of being rebuilt per project.
Read the whitepaper →Professional error handling
Production-ready error handling that doesn’t leak internals.
Read the whitepaper →Source packages
Models, views, controllers and endpoints with async, managers and DI baked in.
Read the whitepaper →Built to resist real attacks.
Harden against the OWASP Top Ten and stay prepared with regular updates and guidance.
Strong password hashing
PBKDF2 salted hashing against dictionary attacks; swap algorithms with ease.
Read the whitepaper →Password / credential blocking
Detect and protect data when credentials are compromised.
Read the whitepaper →Request integrity & expiration
Defeat tampering, man-in-the-middle and replay attacks; define request lifetime.
Read the whitepaper →Integrator identification
Reject connections from clients outside the origin allow-list.
Read the whitepaper →Key-leakage protection
Stop sensitive API keys being used from browsers or non-allow-listed IPs.
Read the whitepaper →Feature hiding
Show menus, actions and pages by privilege level via permission-based authorization.
Read the whitepaper →