EchoPost follows a zero-trust philosophy:

✔ All credentials encrypted
✔ User permission required for every action
✔ Access revocable at any time
✔ Secrets never embedded in code
✔ Least privilege architecture
✔ Regular security audits

If you discover a security vulnerability:

1. DO NOT open a public GitHub issue
2. DO NOT disclose publicly before we've had time to fix it
3. Email: security@echopost.dev
4. Include:
   • Vulnerability description
   • Affected component/version
   • Steps to reproduce
   • Potential impact
   • Suggested remediation (if any)

We will respond within 48 hours and keep you informed of progress.

• Algorithm: AES-256-GCM
• Key Management: Encryption keys stored separately from encrypted data
• Key Rotation: Implemented but keys should be rotated annually
• Authentication Tags: Used to detect tampering

• Algorithm: bcrypt
• Rounds: 12 (current security standard)
• Never stored: Only hashes compared during authentication

• Algorithm: HS256 (HMAC with SHA-256)
• Expiration: 1 hour for access tokens
• Refresh: Refresh tokens valid for 7 days
• Signing Key: Never shared, stored in JWT_SECRET

1. User registers with email and password
2. Password hashed with bcrypt
3. JWT token issued on login
4. Token included in all subsequent requests
5. Server validates token and user permissions

• User: Can manage own content and connected platforms
• Admin: Can view analytics and manage users (future)
• Organization: Multi-user workspaces with role-based access (future)

• Sessions expire after 1 hour of inactivity
• Logout immediately revokes token
• Concurrent session limits enforced
• Audit trail of login/logout events

• All API communications over HTTPS
• TLS 1.2 minimum
• Strong cipher suites required
• Certificate validation enforced

• Allowed origins whitelisted
• Credentials included in CORS requests
• Preflight requests validated
• Cookie-based sessions protected

• Per-user rate limits on all endpoints
• Per-IP rate limits for public endpoints
• Exponential backoff for retries
• DDoS protection enabled

• All user input validated and sanitized
• SQL injection prevention with parameterized queries
• XSS protection with content security policies
• CSRF tokens for state-changing operations

• Dependencies scanned weekly with npm audit
• Security patches applied immediately
• Major version updates tested before deployment
• Automatic security alerts enabled

• npm package integrity verified
• Checksums compared
• Malicious package detection

• Database encrypted with transparent encryption
• Encrypted backups stored securely
• Regular backup testing
• Secure deletion procedures

• All traffic encrypted with TLS
• No sensitive data in logs
• Secure communication between services

• Only necessary data collected
• Data retention policies enforced
• GDPR compliance for user data
• Right to deletion implemented

• Containers run as non-root users
• Read-only root filesystem where possible
• Resource limits enforced
• Security scanning of images

• Private networks for service communication
• Firewall rules configured
• VPC isolation in cloud deployments
• DDoS protection enabled

• Secrets stored in secure vaults
• Never committed to version control
• Rotated regularly
• Access logged and audited

• All code changes require review
• Security-focused review guidelines
• Automated security checks in CI/CD

• SAST tools scan code for vulnerabilities
• Dependency scanning enabled
• Secret scanning in repositories

• Security test cases included
• Penetration testing planned
• Vulnerability scanning enabled

• OWASP Top 10 mitigations implemented
• CWE recommendations followed
• GDPR ready (user data handling)
• Privacy-by-design principles

• Environment variables configured
• Encryption keys generated and secured
• Database backups verified
• HTTPS enabled
• Firewall rules configured
• Rate limiting enabled
• Logging enabled
• Monitoring alerts configured
• Security headers set
• Dependencies up-to-date

1. Use strong passwords - 12+ characters with mixed case, numbers, symbols
2. Enable 2FA - On all connected platforms
3. Review connections - Regularly audit connected applications
4. Rotate tokens - Change platform tokens periodically
5. Keep updated - Update EchoPost and dependencies regularly
6. Report issues - Security vulnerabilities should be reported immediately

In case of a security incident:

1. Immediate action: Service may be taken offline to prevent further damage
2. Investigation: Determine scope and impact
3. Containment: Stop the threat
4. Eradication: Remove the threat
5. Recovery: Restore systems
6. Notification: Affected users notified within 24 hours
7. Post-mortem: Document lessons learned

• Email: security@echopost.dev
• Response Time: Within 48 hours
• Confidentiality: We respect responsible disclosure
• Recognition: Security researchers recognized (opt-in)

For questions about security, contact the security team or open a discussion on GitHub.