Security Issues

Identify any security issues raised by your software. For example:

Identify sensitive information kept by your software. Explain how you plan to protect it.

• Shapeshift will store sensitive user information, like emails, hashed passwords, and birthdays. To protect this data:
  • Password Hashing: We will use bcrypt (or similar) to securely hash passwords, ensuring they aren’t stored as plain text.
  • Secure Database Access: We will limit database access to only essential parts of the app to protect sensitive data.
  • Environment Variables: Sensitive configuration details, such as database credentials and API keys, will be stored in environment variables, secured in .env files, and kept out of the codebase.

Identify possible attack vectors, that is, ways malicious users could try to use your software to escalate their privileges. This includes root access to your server, access to other user's sensitive information (say via XSS attacks), root access to your database, etc. Explain protection plan.

• SQL Injection Attacks: Malicious users inject SQL commands through input fields.

  • Filter inputs to detect and block malicious code
  • Restrict database code to limit queries and prevent unintended access

• Cross-Site Scripting (XSS): Cyberattack where scripts are injected into fields where user data is displayed, potentially running harmful code in another user's browser.

  • Sanitize and encode user input on the frontend
  • Use React’s automatic output escaping to prevent script injections

• Cross-Site Request Forgery (CSRF): Attackers trick users into performing actions unknowingly.

  • Implement CSRF tokens to ensure that only verified requests can modify data

• Privilege Escalation: Attackers attempt to access restricted areas

  • Use role-based access control to check permissions on each request, ensuring only authorized users have access