Security Overview

Security overview for Socira AI. For technical implementation details, see docs/SECURITY.md in the codebase.

Application Security

• Password hashing: bcrypt with cost factor 12.
• Password policy: minimum 10 characters, mixed case, at least one digit, common passwords rejected.
• Account lockout: 5 failed logins → 15-minute cooldown per email.
• Session cookies: HttpOnly, Secure (in production), SameSite=Lax, custom name.
• CSRF: synchronizer tokens on every state-changing POST, validated server-side.
• CSP: strict Content Security Policy with allow-listed script/style sources.
• Headers: HSTS, X-Frame-Options DENY, X-Content-Type-Options nosniff, referrer-policy strict-origin-when-cross-origin.
• Rate limiting: login (10/15min), signup (5/hr), general API (120/min).

Transport & Storage

• TLS 1.2+ for all traffic in transit (Nginx / Cloudflare).
• Encrypted, off-host nightly backups; encryption at rest for storage volumes.
• Least-privilege database access; connection strings held only in server-side environment.

Access & Audit

• Role-based access control: super_admin, client_admin, client_user.
• Super_admin is locked to a single email at both DB and middleware layers.
• Immutable audit log of privileged actions, retained ≥12 months.
• Access to production reviewed quarterly.

Development

• Dependency vulnerability scanning (npm audit) on every deploy.
• Parameterized queries throughout; no string concatenation into SQL.
• Input validation on every route; centralized error handler.
• Code review required before merge.

Incident Response

Suspected security issues → email thetechhackerlabs@gmail.com. Confirmed personal-data breaches are notified to affected customers and regulators within 72 hours as required by GDPR Article 33.

Reporting a Vulnerability

We appreciate responsible disclosure. Email thetechhackerlabs@gmail.com with details. Please give us reasonable time to fix before public disclosure. We will not pursue legal action against researchers acting in good faith.