Most software tells you only what it protects. Here is BOTH halves — because you cannot make a good decision on half a truth.
What AIF DOES protect — and how
Your password is stored as a bcrypt hash — we could not read it if we wanted to. Sign-in attempts are rate-limited and failures are deliberately slowed.
Every form carries a CSRF token — another site cannot forge actions in your name.
Roles gate everything twice — pages check, and the engine checks again underneath. Admin doors render as NOTHING for non-admins, not as greyed-out teases.
The audit trail records sign-ins (with what your browser claimed to be), data exports with row counts, till overrides, drawer moves, imports — read-only, newest first.
Sessions are yours to kill — Devices & Sessions lists every live session and remembers-me device, with one-tap revoke and a sign-out-everywhere switch.
Your data is portable — one-zip export of everything, any time. Lock-in is not a security feature; the exit door is part of the trust.
Data files are shielded by server rules (.htaccess) so /users.json answers 403, not your ledger.
What AIF does NOT protect (yet) — plainly
No two-factor authentication yet. A stolen password is a stolen account until you revoke its sessions. Use a long, unique password.
No encryption at rest beyond your host's. Whoever legitimately administers the server can read the data files. Choose hosting you trust.
Backups are your job. AIF makes them one tap (Export Centre → ONE-ZIP) and nags when they're stale — but it cannot press the button for you.
Email is only as private as email. Password-reset links travel by ordinary email if SMTP is configured.
The till PIN guards the till page only — it says so right on the lock screen. The books stay behind the real login.
Found a hole?
Tell us before you tell the world: huzeyfapoyaaif@gmail.com — machine-readable contact at /.well-known/security.txt (RFC 9116). We fix fast and credit honestly. No lawyers for good-faith reports.
This page states the truth as of the version it shipped with. When a protection is added or a limit removed, this page changes in the same release — never after. · ← accountitfast.com