Skip to content

Security: coderaarav12/Hackathon-TrustOS

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in TrustOS, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, open a private security advisory on GitHub:

  1. Go to the Security tab of this repository
  2. Click Report a vulnerability
  3. Fill in the details

Alternatively, reach out to the maintainers via GitHub: @coderaarav12

Please include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

We will respond within 48 hours and work with you to understand and address the issue.

Security Model

Authentication

  • JWT tokens with HS256 signing
  • Short-lived access tokens (configurable, default 60 minutes)
  • Refresh token rotation on every use
  • Session tokens for extension ↔ backend communication
  • bcrypt password hashing with salt

Data Protection

Data Type Protection
Passwords bcrypt hash + salt, never stored plaintext
API keys Environment variables only, never committed
Session tokens JWT with expiration, validated on every request
Evidence files Stored in configurable directory, access via authenticated endpoints only
Clipboard Character counts only — content never captured or stored
Keystrokes Count-based dynamics — no keylogging, no text capture

Network Security

  • CORS restricted to configured origins (default: localhost:5173, localhost:5174, chrome-extension://*)
  • Rate limiting on all endpoints:
    • Login: 10 attempts/minute
    • Events: 600 events/minute
    • General: configurable per endpoint
  • HTTPS recommended for production deployments
  • WebSocket connections authenticated via JWT query parameter

Privacy by Design

  • No keylogging — only keystroke counts and timing, never text content
  • No clipboard capture — only character counts and paste frequency
  • No screen recording content stored permanently — evidence chunks processed and cleaned
  • Session-scoped data — all monitoring tied to authorized session IDs
  • Consent-based — candidate must activate the extension with a valid access code

Evidence Handling

  • Screenshots, audio, video, and transcripts stored in configurable directory
  • Evidence linked to specific sessions and events
  • File access requires authentication
  • Max file size enforced (default: 200 MB)
  • MIME type validation on upload (blocks executables, allows webm/mp4/mp3/wav/png/jpeg)

AI Engine

  • Mistral API key stored in environment variables only
  • API key never sent to client or logged
  • Offline mock mode when no API key configured
  • Analysis results cached per session, not re-run unnecessarily

Hardening Checklist

For production deployment:

  • Change SECRET_KEY from default placeholder
  • Set strong, unique MISTRAL_API_KEY
  • Use PostgreSQL instead of SQLite
  • Deploy behind HTTPS reverse proxy (nginx, Caddy)
  • Set restrictive CORS origins (not chrome-extension://*)
  • Enable rate limiting
  • Configure proper log levels (not DEBUG)
  • Set APP_ENV=production
  • Use a dedicated database user with minimal privileges
  • Regular database backups
  • File system permissions on evidence storage directory
  • Monitor audit logs

Known Limitations

  • Chrome extension uses chrome-extension://* wildcard CORS in development — restrict for production
  • SQLite is not suitable for production multi-user deployments
  • No CSRF protection (API-only, no browser form submissions)
  • WebSocket has no reconnection rate limit (client-side backoff only)

Scope

The following are in scope for security reports:

  • Authentication bypass
  • Privilege escalation
  • SQL injection
  • XSS via event data or transcript content
  • Evidence file access without authorization
  • API key exposure
  • Rate limit bypass
  • Session token forgery

The following are out of scope:

  • Social engineering attacks
  • Physical access to candidate machines
  • Chrome extension permissions (user explicitly grants them)
  • Denial of service (rate limiting mitigates)

Updates

This security policy is effective as of the date of the latest commit.

For questions about this policy, contact the repository maintainers.

There aren't any published security advisories