Your catalogue, protected.
BASSMA holds the rights, royalties and delivery history for every release on your label. Access is locked down accordingly.
- Passwords are never storedOnly a scrypt hash is kept, with a per-account salt. Sign-in takes the same time whether or not an account exists, so the form cannot be used to discover who has one.
- Five attempts, then a pauseRepeated failures lock the account for 15 minutes. Every attempt, successful or not, is written to an audit log with its IP and device.
- Sessions are signed and shortAn HttpOnly, SameSite cookie holds a signed token that expires after 8 hours and can be revoked server-side. JavaScript can never read it.
