Authentication and authorization

- Biometric implementation (FaceID/TouchID/Fingerprint) - Session management and token expiration - Privilege escalation and IDOR - Account lockout and brute force protection