A stolen database backup shouldn't hand out live sessions

Storing session and invite tokens in plaintext means a database read (a backup, a replica, a compromised query) is equivalent to stealing every active login.

This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.

Buy for $1492 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

If the sessions table stores the literal cookie value a browser sends, then anyone who can read that table -- a database backup, a read replica, a SQL injection elsewhere in the app, an over-broad admin query -- can use those values directly to impersonate every currently logged-in user, no additional cracking required. The cookie and the stored value being identical turns any read access into full session takeover.

Why this one is easy to get wrong

Storing the token as-is is the simplest thing that makes a login system work, and functionally it's indistinguishable from the hashed version in every normal test -- login works, logout works, sessions expire on schedule. The difference only matters in a scenario (someone reads the database who shouldn't) that a functional test suite has no reason to simulate.

What you get instead

Core decision 14 issues a 32-byte crypto.randomBytes token for each session, stores only its SHA-256 hex in the database, and applies the identical discipline to invite tokens in decision 15. The verify suite asserts directly that no stored value in the database equals the plaintext cookie or invite token a client would actually hold -- reading the table gives an attacker nothing they can use.

Source: ARCHITECTURE.md core decision 14-15 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

2 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $149 14-day refund if verify.sh fails →