Security

Last updated: 2026-07-12

Controls

• HttpOnly, Secure (when not in development), SameSite cookies for browser sessions with CSRF protection.
• Passwords hashed with bcrypt; stronger password requirements on signup and reset.
• Tenant-scoped RBAC and module entitlements on API routes.
• Encrypted storage for integration secrets and WhatsApp credentials.
• Outbound URL allowlisting to reduce SSRF risk on webhooks and DB connectors.
• Auth endpoint rate limiting and session revocation.
• Security response headers (CSP, HSTS outside development, X-Frame-Options, etc.).

Status

Service health is published at /status.

Disclosure

Report vulnerabilities to [email protected]. Please include steps to reproduce and avoid accessing customer data beyond what is needed to demonstrate the issue. We aim to acknowledge reports within a few business days.