Protected by hardened password controls, short-lived authentication flows, and server-side sessions.