Report privately:

• 📧 security@yourdomain.com
• 🔐 PGP Key: [link]
• 🛡 HackerOne (optional)

• Description
• Reproduction steps
• Impact
• PoC

• Response: 48h
• Critical triage: <24h

We assume attackers may attempt:

• Credential stuffing
• JWT theft / replay
• SQL injection
• XSS / CSRF
• API abuse / scraping
• Payment manipulation
• Insider misuse

• bcrypt (cost ≥ 12)
• Access token TTL: 15 min
• Refresh token rotation (one-time use)

• Token binding (IP/device fingerprint)
• Session invalidation on:
  • password change
  • logout
  • suspicious activity

• HttpOnly
• Secure
• SameSite=Strict

• RBAC + Attribute-Based Access Control (ABAC)

• A user can only access:

  • their own resources
  • resources matching ownership rules

• Admin actions require:

  • re-authentication OR MFA

Required for:

• Admin accounts
• Payment actions
• Sensitive data access

Supported:

• TOTP (Google Authenticator)
• Email OTP (fallback)

• Content-Security-Policy:
  • default-src 'self'
• X-Frame-Options: DENY
• HSTS enabled (max-age ≥ 1 year)

• Schema validation (Zod)
• Output encoding (prevent XSS)

• IP-based + user-based + device-based

• Login:

  • 5 attempts / min
  • lockout after 10 failures

• API:

  • burst + sustained limits

• Detect:
  • unusual request patterns
  • scraping behavior
• Block:
  • TOR exit nodes (optional)
  • known malicious IPs

• At rest: AES-256
• In transit: TLS 1.2+

• Mask logs (never log tokens/passwords)
• Encrypt:
  • emails
  • phone numbers (if critical)

• Server-side verification ONLY
• Webhook validation:
  • signature check REQUIRED
• Idempotency keys enforced

• Detect duplicate payments
• Validate amount server-side

• Auth attempts
• Failed logins
• Token usage
• Admin actions

• Passwords
• Tokens
• Secrets

Trigger alerts for:

• Multiple failed logins
• Sudden traffic spikes
• Token reuse anomalies

• Lockfile integrity
• No unverified packages

• Fail build on:
  • critical vulnerabilities
  • outdated dependencies

• SAST (static analysis)
• DAST (runtime testing)
• Fuzz testing for APIs

• Test malformed JSON inputs
• Test auth bypass attempts

• No secrets in code EVER

• AWS Secrets Manager / Vault

• Rotate every 30–90 days
• Separate per environment

• Use reverse proxy (NGINX / Cloudflare)
• WAF enabled (Web Application Firewall)

• Private DB subnet
• No public DB access

• Never trust:
  • client input
  • internal services

• Service-to-service authentication
• Internal API verification

1. Detect anomaly
2. Contain (block IP / revoke tokens)
3. Investigate logs
4. Patch vulnerability
5. Notify users
6. Postmortem

We support ethical security research.

Allowed:

• Testing within scope

Not allowed:

• Data destruction
• Service disruption

• Daily encrypted backups
• Tested restore procedures

• Least privilege
• Defense in depth
• Fail securely
• Assume breach

Security is enforced at:

• Code level
• API level
• Infrastructure level
• Operational level