Security

At DCYFR Labs, security is fundamental to everything we build. This page outlines our security measures, vulnerability reporting process, and our commitment to transparency.

Our Security Commitment

We prioritize security across all our systems and processes through:

• Privacy-First Approach: Minimal data collection by design
• Transparent Practices: Open about our security measures and incidents
• Proactive Monitoring: 24/7 automated security scanning and alerting
• Continuous Improvement: Regular audits and security updates
• Responsible Disclosure: Clear process for reporting vulnerabilities

Security Measures

Infrastructure Security

• HTTPS/TLS 1.3: All connections encrypted with the latest TLS protocol
• Content Security Policy (CSP): Nonce-based CSP Level 2+ preventing XSS attacks
• Subresource Integrity (SRI): External resources verified with cryptographic hashes
• DDoS Protection: Vercel’s edge network with built-in attack mitigation
• HSTS: HTTP Strict Transport Security enforcing secure connections
• Security Headers: X-Frame-Options, X-Content-Type-Options, and more

Application Security

• Input Validation: All user inputs validated and sanitized
• SQL Injection Prevention: Parameterized queries and prepared statements
• XSS Protection: CSP enforcement and automatic output escaping
• CSRF Protection: Token-based CSRF protection on all state-changing operations
• Rate Limiting: API endpoints protected with adaptive rate limits
• Session Security: Encrypted sessions with AES-256-GCM, automatic expiration

Data Security

• Encryption in Transit: TLS 1.3 for all data transmission
• Encryption at Rest: AES-256-GCM for session data and sensitive information
• Minimal Data Collection: Only essential data collected (see Privacy Policy )
• No Persistent Tracking: No cookies, no cross-site tracking
• Automatic Data Deletion: Sessions (24-48h), logs (30d), errors (90d)
• Access Control: Strict authentication and authorization for all systems

Monitoring & Detection

• 24/7 Monitoring: Automated security monitoring via Sentry
• Real-Time Alerting: Immediate notifications for security events
• CodeQL Scanning: Automated code analysis for vulnerabilities
• Dependabot: Automated security updates for dependencies
• Monthly Audits: Regular security assessments and penetration testing
• Incident Response: Documented procedures for security incidents

Reporting Security Vulnerabilities

If you discover a security vulnerability, please report it responsibly. We appreciate your efforts to improve our security.

How to Report

DO NOT create a public GitHub issue for security vulnerabilities.

Instead, use one of these secure methods:

1. GitHub Security Advisories (Preferred)

• Visit Security Advisories
• Click “Report a vulnerability”
• Provide detailed information using the template

2. Direct Contact

• Use our contact form
• Include “SECURITY VULNERABILITY” in the subject line
• Provide all details listed below

What to Include

When reporting a vulnerability, please include:

• Type of Issue: XSS, CSRF, injection, authentication bypass, etc.
• Location: File path, URL, or affected component
• Steps to Reproduce: Detailed, step-by-step instructions
• Impact Assessment: What an attacker could potentially do
• Suggested Fix: If you have one (optional but appreciated)
• Contact Information: For follow-up questions

Response Timeline

• Initial Response: Within 48 hours
• Status Update: Within 5 business days
• Fix Timeline: Based on severity (see below)

Severity Classification

• Critical (24-48 hours): Remote code execution, authentication bypass, data breach
• High (1 week): XSS, CSRF, privilege escalation
• Medium (2 weeks): Information disclosure, DoS vulnerabilities
• Low (4 weeks): Minor information leaks, low-impact issues

Security Best Practices

For Users

• Keep your browser and operating system updated
• Use strong, unique passwords (if authentication features are added)
• Enable two-factor authentication (when available)
• Report suspicious activity immediately
• Verify you’re on dcyfr.ai (check the URL and certificate)
• Be cautious of phishing attempts impersonating DCYFR Labs

For Developers

• Follow our security guidelines in CONTRIBUTING.md
• Never commit secrets, API keys, or credentials to the repository
• Run security checks before submitting pull requests
• Review our SECURITY.md in the repository
• Use design tokens (prevents CSS injection vulnerabilities)
• Validate all inputs, sanitize all outputs
• Follow the principle of least privilege

Security Certifications & Compliance

• GDPR Compliant: Privacy by design with minimal data collection
• WCAG 2.1 AA Compliant: Accessibility standards reduce security risks
• CSP Level 2+: Nonce-based content security policy preventing injection attacks
• Automated Scanning: CodeQL, Dependabot, and Lighthouse CI continuous monitoring
• Industry Standards: Following OWASP Top 10 and CWE/SANS Top 25 guidelines

Third-Party Security

We rely on industry-leading providers with strong security certifications:

Vercel (Hosting)

• SOC 2 Type II certified
• ISO 27001 certified
• GDPR and CCPA compliant
• Vercel Security

GitHub (Code Repository)

• SOC 1, SOC 2, and SOC 3 reports
• ISO 27001 and ISO 27018 certified
• Advanced security features (Dependabot, CodeQL, Secret Scanning)
• GitHub Security

Sentry (Error Monitoring)

• SOC 2 Type II certified
• GDPR compliant with PII scrubbing
• Automatic data sanitization
• Sentry Security

Inngest (Background Jobs)

• SOC 2 Type II certified
• GDPR compliant
• Transient data processing (7-day retention)
• Inngest Security

Security Resources

• Security Policy (GitHub) - Detailed vulnerability reporting process
• Security Advisories - Published security notices
• Privacy Policy - How we protect your data
• Terms of Service - Legal agreements and user responsibilities
• Contact Us - Report security concerns

Security Updates

We continuously update our security measures and respond promptly to new threats.

For security notices and updates:

• GitHub Security Advisories - Official security announcements
• Activity Feed - Real-time updates on security improvements

DCYFR Labs Security Policy Questions or security concerns? Contact us or report vulnerabilities via GitHub Security Advisories.