Security Policy

Last updated: March 13, 2026

1. Infrastructure Security

The application is hosted on managed infrastructure with automatic scaling, firewall rules, and DDoS protection. PostgreSQL 16 with encrypted connections is used for data storage — the database is not publicly accessible. All traffic is encrypted with TLS and HTTP Strict Transport Security (HSTS) is enforced with a max-age of 2 years. All credentials and API keys are stored as environment variables, never committed to source control.

2. Authentication and Authorization

Authentication is delegated to Auth0 with Google and Microsoft social login — we do not store passwords. Server-side sessions are stored in PostgreSQL with a 7-day TTL. Session cookies are HTTP-only and Secure-flagged. All OAuth flows use cryptographically random state parameters (128-bit) to prevent CSRF attacks. All authenticated API endpoints require a valid session, while public endpoints use unique 256-bit cryptographic tokens.

3. Application Security

All database operations use Drizzle ORM with parameterized queries to prevent SQL injection. React's default output escaping prevents XSS, supplemented by Content-Security-Policy headers. Request data is validated using Zod schemas on the server. Nudge emails are rate-limited to one per participant per 24-hour period.

4. Third-Party Integration Security

We request only the minimum OAuth scopes required. OAuth tokens are stored server-side only and automatically refreshed. Development and production environments use separate OAuth app credentials for all integrations.

5. Security Testing

ESLint with eslint-plugin-security scans all server-side code. Semgrep runs before every deployment. npm audit checks dependencies for known vulnerabilities. TypeScript strict mode with full type checking reduces runtime error surface area.

6. Responsible Disclosure

If you discover a security vulnerability, please report it to hello@getavaili.com. We ask that you give us reasonable time to address the issue before public disclosure.