Already in place

• Passwords stored only as salted hashes
• HttpOnly, SameSite session cookie
• Every change guarded by a CSRF token
• Sign-in rate limited against brute force
• SQLite keeps the full enquiry history