Security Policy

API routes that touch user data require server-side authentication and ownership checks.

Stripe webhooks are verified with Stripe's signing secret and processed idempotently by event id.

Security headers include CSP, HSTS in production, frame protections, content-type protections, referrer policy, and restrictive browser permissions.

Rate limiting uses Upstash Redis when configured and fails closed in production if shared rate limiting is required but unavailable.

Logs redact secrets, tokens, private keys, authorization headers, webhook secrets, and database URLs.

Secrets must live in environment variables or a secret manager such as Doppler or the deployment platform's encrypted environment settings, not in source control.

Local .env files are local fallbacks only and must not be treated as the canonical production source of truth.

If a token, private key, database URL, or webhook secret is exposed, rotate it with the provider immediately and update the secret manager.

Report suspected vulnerabilities, account misuse, or exposed credentials to security@ocoferudition.com.

Do not publicly disclose vulnerabilities before we have had a reasonable opportunity to investigate and remediate.