Skip to content

docs: expand security notes #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
leno23 wants to merge 1 commit into
base: main
Choose a base branch
from
+7 −4
Open

docs: expand security notes #47

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,13 @@ Transfers run as a single atomic operation (a locked DB transaction on Postgres)

## Security notes

- Passwords are hashed with `bcryptjs`
- Transfer sender identity is derived from the signed JWT, not the request body
- Balance and transaction reads are scoped to the authenticated user
- Transfer validation uses recipient email and positive numeric amounts
- Passwords are hashed with `bcryptjs` before they are stored.
- Authenticated routes require `Authorization: Bearer <token>`. The middleware verifies the JWT with `JWT_SECRET` and attaches the decoded user id to the request.
- Transfer sender identity is derived from the signed JWT, not the request body, so clients cannot choose another sender id.
- Balance and transaction reads are scoped to the authenticated user.
- Transfer validation uses recipient email and positive numeric amounts.
- Never commit `.env`, `JWT_SECRET`, `DATABASE_URL`, or provider credentials. Keep local secrets in `.env` and production secrets in the deployment secret manager.
- If `JWT_SECRET` or database credentials are exposed, rotate them immediately. After rotating `JWT_SECRET`, users must sign in again because old tokens will fail with `Invalid token`.

## Contribution flow

Expand Down