Sessions
DigiStudios holds no passwords. Authentication happens on DigiFX, and this site receives a session through a single-use code with a two-minute lifetime, bound to this exact origin and burned on redemption. A captured code cannot be replayed, and it cannot be redeemed for a different site.
Access to media
Media lives in private storage. Nothing is publicly addressable, and the browser never receives storage credentials or storage paths — it holds an opaque title identifier and asks the server to resolve it.
Every playback link is short-lived and signed at the moment you press play. Links are never issued in bulk ahead of time, so a page of titles does not hand out a page of working URLs.
What the browser is not trusted with
Access decisions are made server-side, every time. The interface may hide something, but hiding is not the control — the server refuses regardless of what the interface shows. No secret is ever compiled into the code the browser downloads.
Reporting something
If you have found a vulnerability, report it through DigiFX, which handles security contact for the estate. Please give us a reasonable window to fix an issue before disclosing it publicly.