How it's built.

What it does. Talks to the site over HTTPS only. The site tells browsers to refuse plain HTTP for it (HSTS), and every form carries a CSRF token.

What it stops. Session cookies are Secure, HttpOnly and SameSite, so they're never sent over plain HTTP, can't be read by page scripts, and aren't attached to requests other sites trigger. Other sites can't frame the pages (clickjacking), and browsers aren't allowed to guess file types.

What it does. Answers DNS for nodebug.app, terminates the visitor's TLS connection, and proxies requests on to the server. It adds the visitor's real address in a header the app uses for login lockouts and rate limits.

What it stops. The server's own IP address is never published, and floods of traffic are absorbed at Cloudflare's edge before they reach it.

What it does. Sits in front of the server at the network level. Web ports accept connections from Cloudflare's published address ranges only, and admin access is limited to one address.

What it stops. Nobody can skip Cloudflare by hitting the server directly, which also means nobody can fake the "real visitor address" header to dodge login lockouts.

What it does. Coolify builds each deploy from GitHub into a Docker image and swaps containers with a rolling update. Its Traefik proxy routes nodebug.app to the app container.

What it stops. Secrets like the database password and API keys live in Coolify's runtime environment, not in the repo or the image.

What it does. One Daphne process serves normal pages and live websocket connections (board games, typing races, the canvas) through Django. The container runs as an unprivileged user, not root.

What it stops.

• Passwords are hashed with Argon2, need a number and a symbol, and are capped at 128 characters so nobody can burn CPU with giant ones.
• Five wrong passwords for one username from one address locks that combination out for an hour.
• Sign-ups, password resets, verification emails and email changes are rate limited.
• Uploaded images are fully decoded to prove they're real JPEG or PNG files.
• Websockets only accept connections opened from this site, and every game move is checked on the server. In Battleship, your opponent's ship positions are never sent to your browser.

What it does. PostgreSQL holds accounts, posts and scores. Redis relays live game messages between connections. Uploaded avatars and banners live on a persistent volume. All three are reached over Coolify's private Docker network by internal names.

What it stops. Redis requires a password. Terminally Idle cloud saves are encrypted before they're stored, so a database dump alone doesn't expose them. Deleting an account erases its profile, images, follows and saves.