Security Policy & Architecture

1. Cryptography & Encryption Standards

• Encryption in Transit: All HTTP traffic to QRnaly (web UI, API routes, and public shortlinks) is strictly enforced over modern TLS 1.3 with automated HSTS redirection.
• Encryption at Rest: Relational database records, file assets, and session state are encrypted at rest using industry-standard AES-256 encryption.
• API Key Cryptographic Hashing: REST API secret keys are presented to Workspace Owners exactly once at generation time. The database retains only a one-way cryptographic SHA-256 hash and a masked suffix for verification.
• Salted Telemetry IP Hashing: Public scanner IP addresses processed during dynamic redirection are salted and cryptographically hashed before insertion into PostgreSQL to prevent scanner tracking.

2. Authentication & Session Security

• HTTP-Only Cookie Sessions: Authenticated sessions use HTTP-only, secure, same-site cookies to prevent token extraction via cross-site scripting (XSS).
• CSRF Protections: Mutation API routes are protected by origin matching and anti-CSRF headers.
• Row-Level Concurrency Locking: Quota deduction and credit ledger updates execute within atomic PostgreSQL transactions using FOR UPDATE row locking to prevent race conditions.

3. File Upload Safety & Isolation

Uploaded PDFs and brand images undergo strict validation to prevent malicious payload uploads:

• Magic-Byte Verification: File headers are checked for authentic PDF (%PDF-), JPEG (FF D8 FF), PNG (89 50 4E 47), or WebP signatures. Executable files disguised with image extensions are rejected.
• SVG File Prohibition: Direct SVG file uploads for customer landing pages are prohibited to eliminate stored XSS risks (vector QR SVGs generated by QRnaly are programmatically synthesized via safe internal renderers).
• Storage Isolation: Uploaded media is served from isolated object storage without application code execution privileges.

4. Responsible Vulnerability Disclosure

We welcome responsible security disclosures from independent researchers. If you discover a potential vulnerability in QRnaly, please report it directly to our security team: