Manual import/export is protected with an admin password, CSRF, secure cookies, and login throttling.