# Internet Security
The application uses PHP password hashing, prepared PDO statements, CSRF tokens, HttpOnly/SameSite session cookies, output escaping, role checks and audit logs. Deploy only over HTTPS. Use a dedicated least-privilege MySQL account, daily off-server backups, strong passwords, current PHP versions, server firewall/rate limiting, and periodic security review before production deployment.