Security
On this page
These pages cover protecting user accounts, user credentials, and the tokens your apps receive. To secure the servers and network that run a self-hosted instance, see Harden.
To get security announcements as a FusionAuth customer, log into account.fusionauth.io and make sure your account has the Security Officer role.
Account Protection
Account Enumeration
Learn which FusionAuth responses reveal whether an account exists, and how to reduce what they reveal.
Account Lockout
Learn how to set up user account locking rules.
Advanced Threat Detection
Learn about the FusionAuth Advanced Threat Detection feature that provides various tools to secure your application.
Breached Password Detection
Learn how to configure and use breached password detection.
Risk Signals
Learn about the risk signals that FusionAuth uses to identify suspicious activity and influence intelligent MFA decisionmaking.
Tokens and Keys
Key Master
Learn how to create, import, and manage signing keys and certificates with Key Master.
Key Rotation
Learn how to rotate keys in FusionAuth.
Token Storage
Learn how to secure tokens generated by FusionAuth.
Clients
CIMD Security
Learn how FusionAuth protects itself when it fetches a Client ID Metadata Document from a URL a third party controls.
CORS Reference
Learn about FusionAuth and Cross-Origin Resource Sharing (CORS) configuration.
Compliance
Related
Learn how to set up user account locking rules.
Learn about the FusionAuth Advanced Threat Detection feature that provides various tools to secure your application.
Learn how to rotate keys in FusionAuth.
Learn how to secure tokens generated by FusionAuth.