# How it works

> How each part of goodnight-web works, the code behind it, and why it is built that way.

Each page covers one part of goodnight-web: what it does, the code behind it, and why it is built that way.

The code excerpts are short and copied as is from the repository. Each excerpt shows its file path at the top, so you can find the whole file in the repository.

- [Contact form protection](https://goodnight-web.dev/docs/how-it-works/contact-protection.md): Turnstile verified on the server, a honeypot field, a rule-based spam score, and the Rate Limiting binding.
- [Passkey sign-in](https://goodnight-web.dev/docs/how-it-works/passkeys.md): how admins sign in with passkeys through Better Auth, and why there are no passwords.
- [First admin setup](https://goodnight-web.dev/docs/how-it-works/first-admin.md): how `APP_SECRET` and `ADMIN_EMAILS` stop a stranger from becoming the first admin.
- [When you cannot use or have lost your passkey](https://goodnight-web.dev/docs/how-it-works/passkey-recovery.md): which environments can use passkeys, and how to get the admin back with a manual change in D1.
- [Deleting old inquiries without Cron](https://goodnight-web.dev/docs/how-it-works/data-pruning.md): how the retention period works with no scheduled job.
- [Slack notifications](https://goodnight-web.dev/docs/how-it-works/notifications.md): a short message after the response, with no personal data.
- [No raw IP addresses](https://goodnight-web.dev/docs/how-it-works/ip-hashing.md): how and why only an HMAC of the IP address is stored.