Meridian is built with the same security posture a real institution would need, even though it's a sandbox.
Bcrypt password hashing, TOTP-based two-factor authentication, one-time recovery codes, and account lockout after repeated failed attempts.
HttpOnly, Secure, SameSite cookies, inactivity timeouts, and session regeneration on every privilege change.
2FA secrets encrypted at rest with AES-256-GCM. Every SQL query is parameterized — no string-built SQL anywhere.
Balances are only ever written by one code path, inside database transactions, with row-level locking to prevent double-spend.
Role-based permissions enforced server-side on every admin action, with an append-only audit log of who changed what.
Strict CSP, X-Frame-Options, HSTS, and X-Content-Type-Options on every response.