DEVLOG_3: After doing a lot of research online about industry standard says to make a secure login method. I added a login page that uses email and password, no Google OAuth because Loom is not supposed to be a public website but for personal use.

I’m using better-auth for the actual logic. It hashes passwords with Scrypt so they are never stored in plain text, and it keeps sessions as a row in a sessions table plus a signed httpOnly cookie. The cookie is signed with BETTER_AUTH_SECRET which the installer generates as a random 48 byte value.

Each sessions last 30 days and refresh if they are older than a day, so you dont get logged out mid use.
CSRF is handled by TRUSTED_ORIGINS in the env, a list of origins allowed to make logged in requests, anything not on the list gets rejected :]