Perimeter defense at the network edge — absorbing volumetric and protocol-level attacks before they reach application infrastructure.
✦ Security & trust ✦
A 13-layer architecture, reported honestly.
We publish what each layer of our security architecture is supposed to do, exactly how we test it, and the real, current status of that testing — including the layers we haven't finished yet. A status never shows “tested and passing” until a real test has actually run.
3 Tested & passing
4 Built, testing pending
4 In progress
2 Not yet started
TLS everywhere, with HSTS to prevent protocol downgrade, so no request or response travels in the clear.
Application-layer filtering and per-route rate limits on authentication, PIN verification, and public unauthenticated forms.
Credentials + JWT session strategy with server-side revocation (tokenVersion), a hard absolute session ceiling independent of activity, and a PIN quick-resume path that can only unlock an already-valid session — never cold-start one.
Role-based access control enforced independently at both the page layer (lib/auth/rbac.ts) and the API layer (lib/auth/api-guard.ts), plus data-level tenant isolation beyond simple role checks.
Zod schema validation at every mutation boundary, backed structurally by Prisma's parameterized query builder — no raw SQL string interpolation in any request-handling code path.
NextAuth's built-in CSRF token requirement on state-changing requests, SameSite session cookies, and React's default output escaping against stored/reflected XSS.
AES-256-GCM encryption of sensitive guest contact fields (email, phone) applied at the repository layer, never as Prisma middleware, so plaintext never reaches the database.
Least-privilege database roles (application role scoped to only the schemas/operations it needs, distinct from an administrative superuser) plus encrypted backups with point-in-time recovery.
Environment-scoped secrets (encrypted at the hosting provider), never committed to source control, rotated on any suspected exposure.
Automated tracking of vulnerable or malicious dependencies, with scheduled scans independent of when a developer happens to run one manually.
An append-only record of every sensitive admin action (AdminAuditLog), plus logging of failed logins and PIN lockouts, as a foundation for anomaly detection.
COPPA protections for guest records, a provable legal-acceptance trail (LegalAcceptance versioned against LegalDocument), and a GDPR right-to-erasure flow with a cancellable grace period.
Found something we missed?
We welcome good-faith security research. Report anything through our support system rather than exploiting or publicly disclosing it first — see our Acceptable Use Policy for details.