• OAuth 2.0 with Google for sign-up page
• API key authentication for admin endpoints
• Session management with secure cookies

• SQLite with prepared statements (SQL injection prevention)
• Input validation with express-validator
• XSS protection through proper encoding
• CSRF protection via state parameter in OAuth

• Helmet.js for security headers
• Rate limiting on all endpoints
• CORS configuration for cross-origin requests
• HTTPS enforced in production

• Consent Mode v2 implementation
• GDPR/CCPA compliant consent management
• No PII stored in tracking pixels
• Secure session storage

To report a security vulnerability:

1. DO NOT create a public GitHub issue
2. Email security details to the maintainers
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

# Required security settings
SESSION_SECRET=<strong-random-string>
ADMIN_API_KEY=<secure-api-key>
NODE_ENV=production

# Optional but recommended
SENTRY_DSN=<your-sentry-dsn>
ALLOWED_ORIGIN=https://your-domain.com

• Enable automated backups with Litestream
• Store backups in S3/B2 with encryption
• Test restore procedures regularly
• Run nightly verification: node scripts/backup-verify.js

• Enable Sentry for error tracking
• Monitor /metrics endpoint with Prometheus
• Set up alerts for:
  • Failed authentication attempts
  • Rate limit violations
  • Database backup failures
  • Unusual traffic patterns

• Use Docker containers with non-root user
• Keep dependencies updated: pnpm update
• Run security audits: pnpm audit
• Enable auto-rollback on Fly.io
• Use secrets management for sensitive data

The application sets the following security headers via Helmet:

• Content-Security-Policy
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 1; mode=block
• Strict-Transport-Security (HTTPS only)

Default rate limits:

• General API: 100 requests per 15 minutes
• Sign-up endpoint: 10 requests per hour
• Admin endpoints: 20 requests per 15 minutes

Important security events are logged:

• Authentication attempts
• Admin endpoint access
• Database modifications
• Consent preference changes
• Pixel health issues

Security-critical dependencies:

• helmet: Security headers
• express-rate-limit: Rate limiting
• express-validator: Input validation
• better-sqlite3: Secure database access
• @sentry/node: Error tracking

Run pnpm audit regularly to check for vulnerabilities.

In case of a security incident:

1. Immediate Actions

   • Disable affected services
   • Rotate compromised credentials
   • Enable enhanced logging

2. Investigation

   • Review logs in Pino format
   • Check Sentry for error patterns
   • Analyze Prometheus metrics

3. Recovery

   • Restore from verified backups
   • Apply security patches
   • Update security policies

4. Post-Incident

   • Document lessons learned
   • Update security procedures
   • Notify affected users if required