Security
Security overview
We treat security as production-critical. This page describes the controls the platform implements. We describe what we do rather than claim certifications we do not hold.
Controls
What we implement
Transport
All traffic is served over HTTPS. Cookies used for sessions are HttpOnly, Secure and SameSite.
Input handling
Form input is validated server-side with a schema. Output is escaped to prevent cross-site scripting.
Database access
Queries run through a parameterized ORM to prevent SQL injection.
Abuse controls
Endpoints are rate limited, and forms include bot mitigation. Oversized requests are rejected.
Passwords
Where accounts exist, passwords are stored only as strong one-way hashes, never in plaintext.
Headers
Responses set a content security policy, frame protections, content-type and referrer policies.
Authorization
Administrative routes enforce authorization on the server, not only in the interface.
Errors and logs
Production errors do not leak stack traces. Sensitive actions are recorded in an audit log.
Responsible disclosure
Report a vulnerability
If you believe you have found a security issue, please email us and give us a reasonable time to respond before any public disclosure. We appreciate reports made in good faith and will not pursue action against researchers who follow this policy.
security@octara.org