Identity & security.

The sign-in page is part of the security perimeter. Its operator, purpose and data flow are stated here so the page can be judged in isolation.

Operator and relationship

login.leematulis.com is operated by Lee Matulis. It verifies control of an approved email address for the Kairos War Room and Dream Houses. Cloudflare Access remains the authorization, session, audit and revocation plane around each protected application.

What the page requests

An approved email address and the six-digit, single-use code sent to that inbox. The code expires after ten minutes. This service never asks for an email-account password, recovery phrase, payment card, phone number or software installation.

Data flow

The identity gateway checks whether the address belongs to an approved audience.
The code is delivered through Lee Matulis's mail infrastructure.
A successful check produces a one-minute, single-use authorization code for Cloudflare Access.
Cloudflare Access applies the application's admission policy and returns the reader to the protected service.

No advertising network or third-party analytics script runs on the sign-in page.

Controls

Exact relying-party and redirect allowlists.
Single-use codes, bounded attempts and connection-level throttles.
Secure, HttpOnly, SameSite cookies scoped to the authorization path.
RS256-signed OpenID Connect tokens with short lifetimes and published verification keys.
Content Security Policy, frame blocking, no-store responses and no cross-origin script execution.

Report a security concern

Email me@leematulis.com. Include the URL, time, browser and what you observed. The machine-readable policy is at /.well-known/security.txt.