Passwords are stored as hashes. A signed-in session uses an HttpOnly cookie. Account files are not served as web pages.
For a security questionnaire, email info@authmantra.com from your company address. What is in place today, and what is not yet, is on the Trust & security page. To report a vulnerability, use the subject “Security”.