Security Policy
How we handle security vulnerabilities and protect our users.
Reporting Vulnerabilities
Do NOT open public issues for security vulnerabilities. Email security@anoneurx.com with a detailed description including steps to reproduce, affected components, and potential impact.
Response Timeline
We acknowledge reports within 24 hours, provide an initial assessment within 72 hours, and aim to release patches for critical vulnerabilities within 7 days.
Responsible Disclosure
We ask reporters to give us 90 days to develop and release a fix before public disclosure. We will credit reporters in our security advisories.
Bug Bounty Program
Critical vulnerabilities are eligible for monetary rewards. Severity is assessed using CVSS scoring. Contact security@anoneurx.com for current bounty ranges.
Severity Levels & Bounty
Remote code execution, authentication bypass, data breach
Privilege escalation, stored XSS, SSRF
CSRF, reflected XSS, information disclosure
Open redirect, clickjacking, minor info leak
Security Measures
Authentication
JWT tokens with configurable expiry, refresh token rotation, and bcrypt password hashing
Authorization
Role-based access control (RBAC) with granular permissions checked at middleware level
Input Validation
Server-side validation on all endpoints using Zod schemas and express-validator
SQL/NoSQL Injection
Parameterized queries and express-mongo-sanitize to prevent injection attacks
XSS Prevention
Content Security Policy headers via Helmet.js, output encoding, and sanitized user input
Rate Limiting
Per-IP and per-user rate limits on all API endpoints to prevent abuse and DDoS
CORS
Strict origin whitelisting with configurable allowed methods and headers
HTTPS
TLS encryption enforced in production with HSTS headers