Security

Security

Threat	Defence
SQL injection	Eloquent / query builder with bound parameters; sort and filter values allow-listed; tested with classic payloads.
XSS	React escaping; no dangerouslySetInnerHTML with user data; nonce-based CSP.
CSRF	Laravel CSRF tokens on every state change (X-XSRF-TOKEN); SameSite=Lax cookies.
Clickjacking, sniffing, leaks	frame-ancestors 'self', X-Content-Type-Options, strict Referrer-Policy, Permissions-Policy, HSTS in production.
Brute force	Per-route throttles with separate counters; 5 failed sign-ins lock for 1 minute (15 on the staff login); reCAPTCHA v3/v2.
DoS / floods	RequestGuard rejects odd methods, long URLs, parameter floods, oversized bodies and NUL bytes early; a per-client budget (300 reads/min; writes 60/min and 8/s); nginx limit_req / limit_conn.
Race conditions	Stock decremented in a transaction with lockForUpdate(); idempotency tokens; offers redeemed under the same lock.
Enumeration	Password reset, login and order tracking respond identically whether or not the account or order exists.
Uploads	MIME and extension allow-list, size cap, UUID names, private disk, streamed to admins only, scanned by ClamAV.
Banned users	Temporary, permanent and deep bans matched on canonical e-mail, phone, device cookie, fingerprint, IP and network.
Admin exposure	404 for non-staff, separate login, optional replay-proof TOTP, role permissions on every route, idle timeout, activity log.
Payments	See Payments.
Multi-server	Throttle counters and ban look-ups in a shared store (Redis); a version key invalidates cached bans on every server at once.

Account security

• Two-step sign-in with any authenticator app (RFC 6238), eight hashed single-use recovery codes, and replay protection.
• E-mailed 6-digit codes from a CSPRNG, stored only as an HMAC, 10-minute expiry, single use, 5 tries.
• New-sign-in alerts for IPs not seen in 90 days.

Reporting a vulnerability

Please don't open a public issue. Report privately through Security → Report a vulnerability. Full policy: SECURITY.md.