Appearance
HIPAA-aligned RBAC, salted bcrypt password hashes, and brute-force account lockout defenses.