All legal documents

Security

Last updated: March 16, 2026

1. Security Commitment

sh0 takes security seriously. We implement industry-leading practices to protect your data, accounts, and deployed applications from unauthorized access, modification, and disclosure.

2. Architecture Security

2.1 Network Security

  • TLS 1.3: All data in transit encrypted with the latest standard
  • HSTS: HTTP Strict Transport Security enabled
  • CORS: Cross-Origin Resource Sharing configured securely
  • WAF: Web Application Firewall to prevent attacks
  • DDoS Protection: Cloudflare DDoS mitigation
  • Rate Limiting: API rate limiting to prevent abuse

2.2 Infrastructure Security

  • Providers: Contabo and Hetzner (ISO 27001 certified)
  • Firewalls: Hardware and software firewalls configured
  • Network Segmentation: Separate networks for different services
  • Container Isolation: Each deployment runs in its own isolated container
  • Backup Systems: Isolated, encrypted backups with configurable retention

3. Authentication & Authorization

3.1 Password Security

  • Hashing: Argon2 with salt for all passwords
  • Minimum Requirements: 8+ characters, mixed case, numbers/symbols
  • Password Reset: Secure token-based password reset (1-hour expiry)
  • No Storage: We never store plain-text passwords

3.2 Two-Factor Authentication (2FA)

  • TOTP: Time-based One-Time Password (Google Authenticator, Authy)
  • Backup Codes: Recovery codes for account recovery
  • Recommended: Available for all users, required for admin access

3.3 Session Management

  • JWT Tokens: Signed, expires in 24 hours
  • Refresh Tokens: Secure refresh token rotation
  • Session Timeout: Auto-logout after 30 minutes of inactivity
  • Concurrent Sessions: Limit to prevent unauthorized access
  • Secure Cookies: HttpOnly, Secure, SameSite flags

4. Data Encryption

4.1 In Transit

  • Protocol: TLS 1.3 (minimum)
  • Certificate: Automatic SSL via Caddy (Let's Encrypt / ZeroSSL)
  • Perfect Forward Secrecy: Enabled (ephemeral keys)

4.2 At Rest

  • Algorithm: AES-256-GCM encryption
  • Secrets: All secrets, API keys, and environment variables encrypted
  • Database: SQLite with full-disk encryption on storage
  • Key Management: Keys stored separately from data using the ring cryptography library

4.3 Encryption Keys

  • Key Generation: Cryptographically secure random generation
  • Key Rotation: Annual rotation for long-lived keys
  • Access Control: Restricted to authorized systems only

5. Application Security

5.1 Code Security

  • OWASP Top 10: Mitigations for all common vulnerabilities
  • Input Validation: Strict validation on all inputs
  • SQL Injection: Parameterized queries via rusqlite
  • XSS Prevention: Content Security Policy (CSP) enabled
  • CSRF Protection: CSRF tokens on all state-changing requests

5.2 Dependency Management

  • Vulnerability Scanning: cargo-audit for Rust dependencies
  • Version Pinning: Production uses locked versions (Cargo.lock)
  • Supply Chain Security: Verified packages only

5.3 Error Handling

  • Safe Error Messages: No sensitive info in error responses
  • Logging: Errors logged securely via tracing without exposing data
  • Stack Traces: Hidden in production
  • Monitoring: Real-time alerting for anomalies

6. API Security

  • API Keys: Encrypted, scoped, rotatable
  • Rate Limiting: Per-user, per-IP limits
  • Signature Verification: HMAC-SHA256 for webhook authenticity
  • Bearer Tokens: JWT-based authentication for all API calls

7. Container Security

  • Non-Root Containers: All containers run as non-root by default
  • Network Isolation: Docker networks isolate stacks from each other
  • Resource Limits: CPU and memory limits enforced per container
  • Image Scanning: Base images scanned for known vulnerabilities
  • Read-Only Filesystems: Where applicable, containers use read-only root filesystems

8. Monitoring & Logging

8.1 Security Monitoring

  • Alerts: Real-time alerts for suspicious activity
  • Incident Response: 15-minute response time for critical incidents
  • Health Checks: Continuous container and service health monitoring

8.2 Audit Logging

  • What: Who accessed what, when, from where, what changed
  • Retention: 1 year for audit logs
  • Immutability: Logs cannot be modified after creation
  • Encryption: Logs encrypted in transit and at rest

9. Access Control

  • Principle of Least Privilege: Users only have necessary access
  • Role-Based Access Control: Admin, member, and viewer roles
  • MFA Required: For all administrative access
  • Access Logging: All admin actions logged

10. Reverse Proxy Security

  • Caddy: Automatic HTTPS with OCSP stapling
  • Certificate Management: Automatic renewal, zero-downtime rotation
  • Header Security: X-Frame-Options, X-Content-Type-Options, Referrer-Policy
  • HTTP/2 and HTTP/3: Modern protocol support

11. Security Testing

11.1 Regular Testing

  • SAST: Static Application Security Testing (clippy, cargo-audit)
  • DAST: Dynamic Application Security Testing (runtime analysis)
  • Penetration Testing: Annual external penetration tests

11.2 Vulnerability Management

  • Disclosure Program: Responsible disclosure policy
  • Response Time: Critical = 24 hours, High = 7 days
  • Patching: Emergency patches deployed within hours if needed

12. Incident Response

In case of a security incident:

  1. Detection & Analysis: Identify scope and severity (1 hour)
  2. Containment: Isolate affected systems (4 hours)
  3. Investigation: Determine root cause and impact
  4. Notification: Inform affected users (72 hours max)
  5. Recovery: Restore normal operations
  6. Post-Incident: Review and improve processes

13. Compliance & Certifications

  • GDPR: Compliant (EU data protection)
  • CCPA: Compliant (California privacy)
  • SOC 2 Type II: Planned
  • ISO 27001: Planned

14. Security Reporting

Found a security vulnerability?

  • Email: [email protected]
  • Do Not: Publicly disclose before we have had 90 days to patch
  • We Will: Acknowledge within 24 hours, provide updates regularly
  • Thank You: Security researchers credited (if desired)

15. Contact Security Team