If you discover a security vulnerability within GradBridge, please send an email to the project maintainer. All security vulnerabilities will be promptly addressed.

Please do NOT report security vulnerabilities through public GitHub issues.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: within 48 hours
• Initial assessment: within 1 week
• Fix release: depends on severity, typically 1-2 weeks

• Passwords hashed with scrypt (per-user salt, 64-byte key)
• Session tokens: HMAC-SHA256 signed JWTs
• httpOnly, SameSite=Lax cookies
• 7-day session expiry
• Timing-safe password comparison

• All endpoints require authentication
• Input validation on all routes
• Rate limiting recommended for production
• CSRF protection via SameSite cookies

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Content-Security-Policy (restrictive)
• Strict-Transport-Security (HSTS)
• Permissions-Policy (camera, mic, geo disabled)

• All user-scoped resources linked via userId
• Cascade deletes for user data isolation
• Parameterized queries (Prisma ORM)
• No raw SQL injection vectors

1. Set GRADBRIDGE_SECRET to a strong random value
2. Use HTTPS in production (Vercel does this automatically)
3. Enable database connection pooling (Neon/Supabase)
4. Set up monitoring and error tracking
5. Regular dependency updates

Designed & Developed by Rhasan