{ }
SELECT A FILE TO VIEW SOURCE
Security Overview
Controls active on the LiidDigital platform. This is the security baseline Rudolf is reviewing against — not a claim of compliance, but a factual list of what's in place.
NETWORK & PERIMETER
✓
Cloudflare
All subdomains route through Cloudflare. DDoS mitigation, WAF rules, and bot challenge active at the edge. Origin server IP is not publicly exposed.
✓
SSL on all subdomains
Every subdomain (api, app, n8n, prospector, stockbot, staging, review, and others) has an individual Let's Encrypt certificate via Certbot. HTTP redirects to HTTPS on all server blocks. Certificates auto-renew.
✓
Fail2Ban
Fail2Ban monitors SSH auth logs and nginx error logs. Repeated auth failures trigger automatic IP banning. SSH runs on port 2222 (non-standard), key-only auth, root login disabled.
APPLICATION LAYER
✓
Rate Limiting
express-rate-limit enforces 100 requests per 15 minutes globally, and 10 requests per 15 minutes on all authentication endpoints (/api/reseller/login, /api/admin/login). Rate limits apply per real client IP via X-Real-IP forwarding from nginx — not the nginx proxy IP.
✓
JWT Authentication
All protected routes require a Bearer JWT signed with a secret from environment variables. Tokens encode role (admin / reseller / client) and are verified on every request. No server-side session state.
✓
bcrypt Password Hashing
Passwords stored using bcryptjs. Plaintext passwords are never stored or logged anywhere. Password reset uses time-limited signed tokens delivered via email.
✓
Parameterised SQL Queries
All database queries use node-postgres with $1/$2 parameterisation throughout. No string interpolation in SQL. SQL injection is structurally prevented at the query layer.
✓
HMAC Webhook Verification
Inbound webhooks (PayFast payments, internal bridge callbacks) are verified with HMAC-SHA256 signatures before any business logic runs. Invalid signatures return 401 immediately.
✓
Helmet.js Security Headers
Express Helmet middleware sets Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, and HSTS headers on all API responses.
✓
CORS Whitelist
Cross-Origin requests are restricted to an explicit origin whitelist. Unknown origins are rejected. Wildcard CORS is not used. White-label reseller domains are loaded from the database and refreshed every 5 minutes.
INFRASTRUCTURE & OPS
✓
PM2 Process Management
All services run under PM2 with memory limits and auto-restart policies. Crash loops are bounded. Services run as liidadmin or root where required — not as www-data with excessive permissions.
✓
PostgreSQL in Docker
Database runs in an isolated Docker container (liiddigital-postgres). No external port binding — accessible only on localhost. Docker network isolation prevents lateral access from other services.
✓
Backblaze B2 Offsite Backups
Automated PostgreSQL dump nightly at 02:00 SAST (7-day local retention at /opt/backups/). Offsite sync to Backblaze B2 bucket at 02:30 SAST via rclone (30-day retention). Backups tested periodically.
✓
Uptime Kuma Monitoring
Uptime Kuma monitors all public services and sends Telegram alerts on downtime. Provides real-time status visibility and incident response lead time.