Security by reduction.

Searches require an authenticated account, CSRF validation, an accepted research agreement and available credits. One email address is accepted per request. Raw passwords, session tokens and underlying file contents are not returned. Account passwords are salted and hashed. Server credentials are never sent to the browser.