If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public GitHub issue
- Email security details to the maintainers
- Include steps to reproduce
- Allow reasonable time for a fix before public disclosure
- Better Auth with secure session management
- OAuth support (GitHub, Discord)
- bcrypt password hashing
- Session expiration and rotation
- API keys encrypted with AES-256-GCM
- CSRF protection on all state-changing operations
- Input validation with Zod on all endpoints
- SQL injection prevention via Prisma ORM
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin
- X-XSS-Protection: 1; mode=block
- Permissions-Policy configured
- Rate limiting on all endpoints
- API keys never exposed to frontend
- All Roblox API calls proxied through backend
- Error messages sanitized in production
| Version | Supported |
|---|---|
| 1.0.x | Yes |
- Use HTTPS in production
- Set a strong
AUTH_SECRET - Use a 32-byte hex
ENCRYPTION_KEY - Keep dependencies updated
- Use environment variables, not hardcoded secrets
- Set up database backups
- Monitor API rate limits