Gamatrain takes security seriously. This document outlines how to report vulnerabilities and best practices for keeping our backend and API endpoints secure.

If you discover a security vulnerability in the Gamatrain backend or API, please report it responsibly.

Report via: Gamatrain Contact Form

Please include:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Impact assessment
• Any supporting screenshots or logs
• The affected API endpoint(s), if applicable

Important: Do not publicly disclose the vulnerability until a fix has been released.

We will respond within 48 hours and acknowledge your contribution once the issue is resolved.

• Use ASP.NET Core Identity, JWT, or OAuth2 for secure authentication.
• Enforce role-based access control (RBAC) for sensitive endpoints.
• Use strong password policies: minimum 12 characters with complexity rules.
• Protect API endpoints with proper API key or token validation where applicable.

• Encrypt sensitive data at rest and in transit (AES-256 recommended).
• Use HTTPS / TLS 1.2+ for all client-server communications.
• Protect tokens, keys, and secrets using ASP.NET Core Data Protection or Azure Key Vault.

• Validate all incoming requests using model validation attributes ([Required], [StringLength], [Range]).
• Sanitize user inputs to prevent SQL Injection, XSS, or Command Injection.
• Use parameterized queries or EF Core LINQ instead of raw SQL.
• Apply strict JSON schema validation for API requests when possible.

• Log all security-relevant events (logins, failed authentication, admin actions, API key usage) with sensitive data redacted.
• Monitor unusual patterns, such as repeated failed login attempts or abnormal API request rates.

• Keep NuGet packages up-to-date.
• Monitor for vulnerabilities in dependencies using Dependabot or OWASP Dependency-Check.

• Implement rate limiting on critical endpoints (e.g., login, token minting) to prevent brute-force attacks or DoS attacks.
• Consider per-user and per-IP throttling for public-facing APIs.

• Never hardcode secrets, API keys, or database credentials.
• Store secrets in environment variables or secure vaults.
• Rotate keys and tokens periodically.

• Security patches and updates will be documented in the release notes.
• Users and integrators are strongly advised to update immediately when a security release is published.

We appreciate security researchers and community members who responsibly report vulnerabilities. All contributors will be credited if they wish to be publicly acknowledged.