Passwordless auth
Sign-in uses first-party email one-time codes. Login codes are hashed before storage and expire quickly.
Security
Security for controlled Markdown review.
Edith protects drafts, feedback, assets, review links, share links, and AI access with product controls that keep collaboration simple and secure.
Control plane
Built around least surprise.
People get clean web workflows. Agents and integrations get scoped MCP and API access. Links stay bearer-style but random, hashed, revocable, and bounded by document context.
Passwordless
One-time email codes, no reusable password database.
Hashed tokens
Session, login, review, share, and access-token secrets are hashed at rest.
Scoped access
Access tokens carry explicit MCP and API scopes and can be revoked.
Sanitised Markdown
Raw HTML is dropped before rendered document output.
Protected sessions
Session tokens are stored as hashes and sent through secure, HTTP-only, same-site cookies in deployed environments.
Browser request safety
Browser form posts use CSRF protection. Login-code requests, OAuth token flows, and anonymous review writes are rate limited.
Review and share links
Review and share URLs use random tokens; Edith stores token hashes and supports revocation from document sharing controls.
MCP and API access controls
AI clients and integrations connect through scoped MCP or API access tokens, or OAuth flows. Tokens can be scoped to read/write areas and revoked from settings.
Markdown and assets
Comments and suggestions are escaped. Workspace assets require workspace access; public review/share asset routes only serve referenced files for the matching link.
Edge and origin
Protected before traffic reaches the app.
Edith runs with Cloudflare in front of the origin for DNS proxying, strict TLS, HTTPS redirects, managed security rules, and coarse abuse limits.
Origin control
Production firewall rules restrict web traffic to Cloudflare IP ranges.
HTTPS first
Cloudflare enforces HTTPS and Full (strict) TLS to the origin.
Abuse filters
Managed rules and coarse rate limits protect common anonymous endpoints.
Agent aware
MCP and API endpoints use authentication, rate limits and abuse controls designed for programmatic access.