Skip to content

Security posture

See SECURITY.md in the repo for the disclosure policy.

What's hardened today

  • Secrets hygiene. gitleaks runs in pre-commit and CI. Startup refuses placeholder JWT_SECRET_KEY / AUDIT_HMAC_MASTER_KEY.
  • Rate limits. slowapi-backed per-user and per-IP limits on login (5/min), register (3/hr), chat (30/min), upload (10/hr).
  • Per-org daily chat cap. Redis counter bounds LLM spend per org.
  • JWT validation. python-jose >= 3.4 (algorithm-confusion CVE fixed in 3.4).
  • CORS. Credentials off (bearer-token only), methods and headers whitelisted.
  • Upload hardening. Magic-byte MIME sniff (blocks spoofed Content-Type), hard size cap enforced before full-body read, path-traversal sanitation on filenames, resolved-path assertion stays under the org's directory.
  • Password policy. 12-char minimum (NIST SP 800-63B baseline).
  • CSP. Content-Security-Policy header in Caddy config restricts script-src to self, blocks inline scripts.
  • Append-only at the DB role level. REVOKE UPDATE/DELETE/TRUNCATE ON audit_logs FROM lexcustis — no bypassable PG RULE.
  • Tenant isolation. Four integration tests in CI enforce cross-org queries cannot read audit log, documents, or RAG, and chains are independent.

Known gaps (deferred to v0.2 / paid)

  • Refresh-token revocation store. Stateless JWTs mean a stolen refresh token is valid until expiry (default 7 days). Server-side revocation lands in commercial edition.
  • Column-level envelope encryption of user_prompt / ai_response. Currently plaintext in Postgres. Threat model: a stolen DB backup exposes every prompt. Commercial edition ships KMS-wrapped DEK encryption.
  • KMS-backed HMAC. Master key is an env variable in OSS v0.1. Commercial edition holds it in Scaleway / AWS / GCP KMS and never exposes the bytes to the application.
  • Security headers beyond CSP. Permissions-Policy, X-Content-Type-Options, X-Frame-Options, HSTS are set, but a deployment-specific audit by an external firm is on the commercial roadmap.
  • Secret rotation UX. Currently manual. Commercial edition automates.

Verification your team can run

  • docker compose config — validates compose syntax.
  • pytest -q in backend/ with TEST_DATABASE_URL set — runs tenant-isolation integration tests + HMAC unit tests.
  • pre-commit run --all-files — gitleaks + hygiene hooks.
  • npm run build in frontend/ — full Next.js production build catches TS + server-component errors.

CI runs the first three on every PR.

Reporting a vulnerability

Don't open a public GitHub issue. Email contact@lexcustis.eu. We acknowledge within 72 hours, fix Critical/High within 14 days, coordinated public disclosure at 90 days.

See full policy: SECURITY.md.