Authentication and sessions
Passwords are hashed with Argon2id. Sessions use strict cookie handling, HTTP-only cookies, secure cookies when HTTPS is active, and session ID rotation on successful sign-in.
Security
Friendly forms still deserve serious security.
Security is a non-negotiable part of Chimera Forms. The application is built so public form behavior, account actions, updates, uploads, and response access are checked at the server instead of being trusted because the browser said everything looked fine.
CSRF protection
State-changing administrative requests use CSRF tokens. A form submission from the public embed has its own nonce model and does not reuse administrator authorization.
Authorization on the server
Ownership and collaborator roles are checked when forms, responses, settings, publishing controls, and management areas are accessed. Hiding a button in the interface is not treated as authorization.
Prepared database access
Application data is accessed through prepared PDO statements with emulated prepares disabled. User input is not concatenated into SQL queries as a shortcut.
Logic and validation are authoritative
Required fields, date rules, hidden values, display logic, and quota state are checked again on the server. A modified browser request cannot make a hidden answer magically become trusted.
Content Security Policy
The admin application uses a restrictive Content Security Policy and same-origin scripts. When a CSP conflict appears, the fix is to move behavior into trusted bundled code rather than quietly turning the policy off.
Signed updates
Incremental update packages are signed with Ed25519. Chimera checks the release signature and SHA-256 payload hashes before applying the package, and database migrations are tracked as part of the update process.
Upload handling
Hosted-page branding images are decoded and validated as images, resized to a maximum width of 1920 pixels, normalized to WebP, stored with generated filenames, and served through the application.
Audit trail
Important application actions can be recorded with the user, object, timestamp, and a keyed hash of the originating IP address. Audit failures do not take the main application offline.
Public forms
Embedding a form should not mean exposing an admin secret.
Chimera Forms uses a rotatable public embed token for browser embeds. It is intentionally different from a private administrative key. The token is scoped to the published form and can be limited to approved origins.
Submission nonces are also bound to the form and origin. Quotas, date rules, visibility, and validation are recalculated at submission time.
1Published formOnly the published revision is served.
2Scoped tokenRotatable and origin-aware.
3Server validationLogic, dates, required fields, quotas.
4Stored responseAccepted only after validation succeeds.
A practical note
No security page should pretend software is magically risk-free.
Chimera Forms is designed to take security seriously, but security also depends on the environment where it is deployed. HTTPS, server patching, database permissions, backups, mail configuration, access policies, and operational practices still matter. Security work is ongoing, and the release process treats security fixes as part of normal product maintenance.
Build with confidence