Protected sessions
Pulse signs session tokens and stores them in HTTP-only cookies with SameSite protection. Production cookies are marked Secure.
Security
Security that can be explained, not just badged.
Pulse is still an early product. This page documents the controls implemented in the codebase today and avoids claiming certifications the project has not completed.
Credential protection
Password accounts use bcrypt hashing. Email verification is required before a standard account can enter the workspace.
Optional company SSO
Business deployments can connect an OpenID Connect identity provider with authorization code flow, PKCE, state, and nonce checks.
Workspace audit trail
Approval decisions and change requests are recorded so teams can trace what happened and why.
OIDC SSO configuration
Set the issuer, client ID, client secret, and redirect URI in the deployment environment. Pulse discovers the provider endpoints, uses PKCE for the authorization code exchange, and validates the signed ID token against the provider's JWKS.
Authorization code + PKCE
State and nonce validation
Verified ID-token signature
Optional just-in-time provisioning