Strong password storage
Passwords are never stored as plain text; they are kept with secure hashing.
- Hash-based storage
- Session renewal after login
- Password change flow
Security
Secure sessions and user isolation for your notes
MDNote.dev runs with an architecture that separates user notes from each other and protects the login flow with fundamental security practices.
Password hashing
Session renewal
User-based data isolation
Brute-force protection
Failed login attempts are tracked and risky flows are throttled.
- Login attempt logging
- IP and user signals
- Progressive protection logic
User isolation
Each user only sees and edits their own notes.
- user_id check on notes
- Ownership control on folders
- Admin panel separation
Session
The login flow puts account security at the center.
Registration and login processes work with fundamental security practices like password hashing, active user checks, and session renewal. Failed attempts are tracked to throttle risky login behaviors.
- No plain text password storage
- Session regenerate on successful login
- Failed attempts recorded
Data boundary
Note access is narrowed through user ownership.
The MDNote application is separated from the panel. Regular users access their own note area, not management modules. Since note and folder operations are scoped by user ID, cross-account data mixing is prevented.
- /notes focused flow for regular users
- auth:admin filter on admin modules
- User-based scope in note queries
This page describes the application-level security approach; it is not an end-to-end encryption promise.
Security practice
What should users pay attention to?
Account hygiene is as important as application security in protecting your notes.
Strong password
Choose a hard-to-guess password not used on other services.
Shared devices
Log out when you are done on shared computers.
Sensitive data
Follow your organization's policy when writing secrets, passwords, or customer data in notes.
Support notification
Report suspicious account behavior through the contact channel.
FAQ
Questions about security
Are notes end-to-end encrypted?
This page describes the current application-level session and user isolation approach. End-to-end encryption should be considered as a separate product feature.
Can a regular user access the admin panel?
Panel modules are protected with an admin filter. Regular user flow runs under the MDNote note area.
Are failed login attempts monitored?
Yes. The login attempt infrastructure records failed attempts and uses them to throttle risky repetitions in the login flow.