Security Policy

Security Policy

Data in transit

All connections are served over HTTPS with TLS. Database connections between the application and MySQL use TLS when certificates are provided. No data is transmitted in plaintext.

Data at rest

The MySQL database uses InnoDB tablespace encryption (AES-256). Uploaded image files are stored with restrictive file permissions: directories are 700 (owner-only access), files are 600 (owner read/write only). Your signature data never leaves your browser.

Image upload security

Uploaded files go through multiple validation layers before being stored:

  • Magic byte validation: the first bytes of the file are checked against known image signatures (JPEG, PNG, GIF, WebP). We do not trust the Content-Type header.
  • File size limits enforced server-side (configurable, default 5MB).
  • Rate limiting: each IP is limited to a configurable number of uploads per minute.
  • COS URLs use content-addressed hashes derived from the file content plus a secret salt. URLs are not guessable.
  • Filenames are truncated and never used in file paths. All stored files use generated hex hashes.

Path traversal protection

URL path segments in image retrieval are validated to contain only lowercase hex characters. After constructing the file path, symlinks are resolved and the final path is verified to still be inside the upload directory. Any mismatch is logged and blocked.

Application security

  • All user input in signature HTML is escaped to prevent XSS.
  • Database queries use parameterized statements to prevent SQL injection.
  • Every response includes security headers: X-Content-Type-Options, X-Frame-Options, HSTS, Referrer-Policy, Permissions-Policy.
  • FastAPI docs, redoc, and OpenAPI endpoints are disabled in production.
  • Unhandled exceptions return a generic error message. The actual error is logged server-side only.

Configuration

All secrets, API keys, and configuration values are read from an environment file (keys.env) that is git-ignored. No secrets are hardcoded in source code. A keys.env.example file is provided as a template.

Reporting vulnerabilities

If you find a security issue, email info@carpathian.ai. We take every report seriously.