Built secure by default.
Security is not a feature bolted on at the end — it is the foundation iProfile is built on. Here is how we protect your account, your site, and your visitors.
Last updated: February 1, 2025
Argon2id password hashing
Your password is never stored in plain text. We hash it with argon2id — the current OWASP-recommended password hash — with memory-hard parameters tuned for production.
CSRF protection
Every state-changing request (POST, PUT, PATCH, DELETE) is protected by the double-submit cookie pattern. The client must echo the CSRF token via the X-CSRF-Token header or a form field, verified in constant time.
Rate limiting
Authentication endpoints, public forms, and APIs are rate limited per IP. Account lockout kicks in after repeated failed logins to blunt credential-stuffing attacks.
Content-Security-Policy
A strict CSP is applied to every response, with frame-ancestors denied, no inline scripts except where strictly necessary, and no third-party origins by default. Combined with X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, and HSTS in production.
Parameterized queries
All database access uses parameterized queries. No string-interpolated SQL exists anywhere in the codebase. Input is validated with zod at every API boundary.
Secure sessions
Sessions are stored in secure, httpOnly, same-site cookies with rotation on login. Tokens are hashed at rest. You can view and revoke active sessions from your account at any time.
Audit logging
Sensitive actions — logins, password changes, role changes, deletions — are recorded in an audit log for security review and forensic analysis.
No third-party trackers
iProfile ships no Google Analytics, no Facebook Pixel, no behavioral trackers. Analytics on user sites is first-party and cookieless. Your visitors are not surveilled.
Defense in depth
No single control is enough. We layer security measures across the stack so that if one fails, others hold the line. Every layer is reviewed regularly and improved as the threat landscape evolves.
- Principle of least privilege on every access check.
- Constant-time comparison for all secrets and tokens.
- Output encoding and sanitization to prevent XSS.
- Account lockout after repeated failed login attempts.
- Secure, httpOnly, same-site cookies for all sensitive values.
- Strict input validation (zod) at every API route boundary.
- Periodic dependency review and security patching.
- Email verification required before first sign-in (except in dev).
Security headers on every response
Every page and API response carries a strict set of security headers. Here is a representative subset:
| Header | Value (abbreviated) |
|---|---|
| Content-Security-Policy | default-src 'self'; frame-ancestors 'none'; ... |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
| Cross-Origin-Opener-Policy | same-origin |
| Strict-Transport-Security | max-age=63072000; includeSubDomains (prod) |
Responsible disclosure
Found a vulnerability? Thank you for helping keep iProfile and our users safe. Please email security@iprofile.example with details and reproduction steps. We acknowledge every report within 48 hours and work with reporters to remediate and credit valid findings.
Please do not attempt to access, scan, or test systems that you do not own or do not have explicit permission to test. Do not degrade service for other users.