• Admin login is protected by a password stored as an environment variable (ADMIN_PASSWORD).

• Sessions are stateless — tokens are verified on every request.

• All admin routes are excluded from search engine indexing.

• Uploaded files are stored in persistent server storage.