Please read the documentation linked in the ReadMe and you can try out all the security features.
There are docs for auth model, the code around it, the limitation of in-mem tokens, the clear documentation around token handling, the code to support CORS, trusted host middleware, CSP, HSTS, rate limiting. You can read the env.template and configure and try it out. I doubt there are self hosted (vibe coded, ai-assisted or even non vibe coded) existing apps which have these security feature in v0.1 or even later.
Like mentioned in comment and ReadMe the project is written with AI assistance not vibe coded or AI driven development. If you will read the code, look at design and db model you will find the answers you are seeking. Having said that I am always looking to make the project better so if you find anything which can be improved please open a PR.
Thank you.