Security at Synkora
We take security seriously. Learn about our security practices, how to report vulnerabilities, and our commitment to protecting your data.
Report a Security Vulnerability
If you've discovered a security vulnerability in Synkora, please report it responsibly. Do NOT create a public GitHub issue.
security@synkora.aiWe acknowledge reports within 48 hours and provide regular updates on progress.
Security Features
Encryption at Rest
All sensitive data including API keys, OAuth tokens, and secrets are encrypted using Fernet symmetric encryption.
JWT Authentication
Secure token-based authentication with token blacklisting, version tracking, and automatic refresh.
CSRF Protection
Server-side CSRF token validation with Redis session binding and fail-closed design.
Input Sanitization
Comprehensive XSS protection with 60+ pattern detection covering modern HTML5 attack vectors.
Rate Limiting
Redis-backed distributed rate limiting with per-endpoint configuration and trusted proxy support.
Security Headers
Content Security Policy with nonces, HSTS with preload, X-Frame-Options DENY, and Permissions-Policy.
Security Best Practices
When Using Synkora
- Keep dependencies updated to the latest secure versions
- Use environment variables for all secrets and API keys
- Enable authentication for all production deployments
- Use HTTPS in production environments
- Regularly review access logs and audit trails
- Follow the principle of least privilege for team members
- Configure rate limiting appropriate to your use case
- Use secure session management with sessionStorage
- Enable multi-factor authentication when available
- Regularly rotate API keys and access tokens
When Reporting a Vulnerability
Please Include
- •Description of the vulnerability
- •Steps to reproduce the issue
- •Potential impact assessment
- •Affected versions (if known)
- •Suggested fix (if any)
What to Expect
- •Acknowledgment within 48 hours
- •Regular updates on progress
- •Credit in release notes (if desired)
- •Coordinated disclosure timeline
- •No legal action for good-faith research
Supported Versions
| Version | Status |
|---|---|
| Latest Release | Supported |
| Previous Releases | Not Supported |
We recommend always using the latest version for the best security and features.