Security

Application controls

• Argon2 passwords, breach-password checks, short-lived RS256 access credentials.
• Server-side session-family revocation, single-session policy, idle and absolute expiry.
• One-use hashed verification tokens expiring after one hour; verification does not log in.
• Current persisted account status, role, and email-verification checks at authorization.
• Hashed API keys with cryptographically random 192-bit secrets, quotas, and rate limits.
• CSRF protection, safe redirect validation, shared free-text validation/sanitization, escaped rendering, and browser security headers including CSP.
• Integer credit ledgers, idempotent grants/redemption, and synchronous security writes.

Credentials and deployment

Provider credentials use encrypted vault storage with operator-configured key material. Protect database tokens, JWT keys, Redis credentials, vault keys, mail credentials, and cron secrets. HTTPS and infrastructure access controls remain deployment responsibilities; application code does not prove a specific cloud topology or external certification.

Password and session management

Settings password changes require the current password and a validated replacement. Successful changes revoke sessions and require a fresh sign-in. Logout invalidates the server-side family, including rotated credentials.

Public sharing

Saved lookups and projects can be published as read-only snapshots through an expiring link. The owner chooses a one-hour to 30-day expiry and can revoke the link. Project notes are included only when selected. Later edits do not update an existing snapshot. Anyone with an active link can view the snapshot without signing in, so share it only with intended recipients.

Lookup history retention

Lookup history keeps the newest 15 results per owner across projects for up to 30 days. Shared teams have one 15-result budget. Repeating a lookup in the same project updates that result and restarts its age. Expired results are excluded from history; hourly maintenance deletes expired data and processes older history in batches. The maintenance also removes expired sessions and email verification tokens while preserving valid credentials. Deployment and scheduler configuration must be verified in your environment.

Privacy workflow status

Account export/deletion endpoints currently acknowledge requests; they do not perform complete portability or persisted erasure. Broader retention, residency guarantees, and compliance attestations require separate implementation and operational confirmation. Do not infer them from an architecture proposal.

Reporting a concern

Report security concerns privately to your ThreatMap/ZySec security contact. Include the affected route, time, request ID, and a redacted reproduction. Never share passwords, API keys, cookies, or authorization headers in public reports.