Uploads stay behind a login wall until editors review them.

Registration creates a local SQLite account with name, email, and password. The upload form is only rendered for logged-in users, and every auth attempt passes through CSRF checks, a honeypot field, a simple captcha, and IP-based rate limiting.