Security & Vulnerability Disclosure
Our platform security architecture, threat model mitigations, and coordinated disclosure process.
1. Core Security Architecture
Decoupled Identifiers
Public profile routes and redirect links utilize random cryptographically secure nanoid/alphanumeric tokens, preventing internal database primary key enumeration (IDOR).
Multi-Tenant Scoping
All link mutations, soft deletions, and profile updates enforce authenticated session userId ownership verification directly in database queries.
Constant-Time Auth
Administrative queue endpoints and bearer tokens utilize constant-time cryptographic hash digests to eliminate timing side-channel attacks.
Defensive Rate Limiting
Token bucket rate limiting backed by Redis protects API gateways, authentication endpoints, and public redirect pipelines against brute-force and DDoS attempts.
2. Infrastructure & Transport Protection
- HTTP Security Headers: Strict Content Security Policy (CSP), HTTP Strict Transport Security (HSTS with 1-year maxAge and subdomains), X-Content-Type-Options: nosniff, and X-Frame-Options: DENY.
- Open Redirect & SSRF Defense: All user-supplied destination URLs are sanitized and validated against malicious schemes (e.g. javascript:, data:, file:) before redirect execution.
- Error Boundary Isolation: Stack traces, database schema details, and server internals are suppressed from client API responses and routed to Sentry.
3. Coordinated Vulnerability Disclosure
We take the security of our community and creators seriously. If you identify a security issue, please adhere to responsible disclosure practices:
- Do not perform destructive actions: Avoid accessing or modifying other users' accounts or degrading service availability.
- Report confidentially: Email your technical proof-of-concept and reproduction steps to security@linkforge.bio or create a confidential GitHub Security Advisory.
- Triage & Remediation: Our team will acknowledge reports within 24 hours and provide an estimated timeline for remediation.