Security and Administration
Cendia ships with rate limiting, a strong password policy, secure cookies, signed preview tokens and response compression turned on.
Permissions are set on pages, blocks and media, and child items inherit them. There are six rights: Read, Create, Edit, Delete, Publish and Administer. They apply everywhere content is served: the site, the API, search, the sitemap and even raw media files.
Administrators invite users, assign groups, lock accounts and manage passwords. Groups work as roles. Sites can use any identity provider for their visitors, and Cendia checks access by role.
API keys for AI providers and other services are stored securely and managed from Settings. They're never kept in plain configuration.
A mail provider can be plugged in through configuration: logging only, SMTP or Amazon SES. New installations send nothing until mail is configured.