Security
PropVest uses Auth.js sessions, hashed passwords, role and capability checks, and security headers on every response.
What ships today
Auth.js sessions
Credentials and optional OAuth on the existing PropVest auth stack. We do not rebuild identity.
Signed-in controls
Two-factor, sessions, and password changes live under Settings for the account holder.
Marketplace gates
Tier, capability, and permit checks fail closed on sensitive listing and money routes.