Skip to main content

Security & Compliance

Security measures, best practices, and compliance documentation for the NS Internship Portal.

Security Architecture​

Authentication & Authorization​

ControlImplementationStatus
Password Hashingbcrypt, 10 rounds✅
Access TokensJWT via jose, 15min expiry✅
Refresh TokensSHA-256 hashed, DB-stored, rotated on use, revoked on logout✅
Token RotationAutomatic on each refresh, old tokens revoked✅
Cookie SecurityHttpOnly, SameSite=Strict, Secure in production✅
Role-Based Access Control5 roles, 28 granular permissions✅
API Key ManagementCRON_SECRET header required for cron endpoints✅

Data Protection​

ControlImplementationStatus
SQL Injection PreventionParameterized queries via Supabase✅
CSRF ProtectionSameSite cookies, CORS configured✅
XSS PreventionReact escaping, no innerHTML usage✅
IDOR PreventionOwnership checks on milestones/enrollments✅
Data EncryptionHTTPS/TLS in transit, PostgreSQL at rest✅
Rate LimitingSupabase-backed rate limiter (survives restarts)✅
Input ValidationAll endpoints, sanitization applied✅

Infrastructure Security​

ControlImplementationStatus
DDoS ProtectionVercel Edge Network, automatic mitigation✅
FirewallSupabase IP whitelisting✅
WAFVercel integrated Web Application Firewall✅
SSL/TLSHTTPS enforced, TLS 1.2+✅
Certificate ManagementLet's Encrypt auto-renewal via Vercel✅
Network IsolationPrivate database, no public internet access✅

Third-Party Security​

ServiceSecurity MeasuresStatus
RazorpayHMAC-SHA256 signature verification✅
CloudinarySigned URLs for secure resource access✅
Google OAuthState parameter, PKCE compliance✅
Resend SMTPTLS encryption, API key rotation✅

OWASP Top 10:2025 Compliance​

A01:2025 - Broken Access Control​

Status: ✅ Protected

  • Row Level Security (RLS) enabled on all 26+ tables
  • Ownership checks on user resources (enrollments, milestones, certificates)
  • Permission system with 28 granular permissions across 5 roles
  • Role-based access control with strict hierarchy
  • Server-side validation for all client requests
  • API endpoint authorization checks

A02:2025 - Cryptographic Failures​

Status: ✅ Protected

  • JWT tokens signed with strong 256-bit secret
  • Refresh tokens hashed with SHA-256, DB-stored, rotated on use
  • Passwords hashed with bcrypt (10 rounds)
  • HTTPS/TLS 1.2+ enforced in production
  • Sensitive data never stored in plain text
  • Email verification tokens with expiration
  • Razorpay HMAC-SHA256 signature verification

A03:2025 - Injection​

Status: ✅ Protected

  • Parameterized queries via Supabase client (no raw SQL)
  • Input validation on all 57+ API endpoints
  • TypeScript type safety throughout codebase
  • Sanitization for user-generated content
  • No eval() or dynamic code execution
  • Prepared statements for all database operations

A04:2025 - Insecure Design​

Status: ✅ Protected

  • Security-first architecture design
  • Threat modeling completed during development
  • Separation of concerns between services
  • Principle of least privilege enforced
  • Secure defaults in all configurations
  • Regular security architecture reviews

A05:2025 - Misconfiguration​

Status: ✅ Protected

  • Environment variables for all secrets (never in code)
  • Secure defaults in configuration files
  • RLS policies enabled on all critical tables
  • Production vs development configuration separation
  • Regular security configuration audits
  • Automated security scanning in CI/CD

A06:2025 - Vulnerable & Outdated Components​

Status: ✅ Protected

  • Regular dependency updates (weekly monitoring)
  • npm audit used for vulnerability scanning
  • Dependabot automated security updates
  • Version pinning for stability and security
  • Security patch application within 48 hours
  • SBOM (Software Bill of Materials) maintained

A07:2025 - Authentication Failures​

Status: ✅ Protected

  • JWT with automatic refresh token rotation (15min access, 30day refresh)
  • Multi-factor authentication readiness (Google OAuth integration)
  • Password complexity requirements (8+ chars, mixed case, numbers)
  • Account lockout after failed attempts
  • Session management with automatic logout
  • Disposable email blocking (16+ domains)
  • Brute force protection via rate limiting

A08:2025 - Software & Data Integrity Failures​

Status: ✅ Protected

  • HTTPS enforced (HSTS headers in production)
  • API signatures verified (Razorpay HMAC-SHA256)
  • Automatic security updates via Vercel
  • SBOM tracking for all dependencies
  • Code signing and integrity verification
  • Supply chain security monitoring

A09:2025 - Logging & Monitoring Failures​

Status: ✅ Protected

  • Activity logging for admin actions (28 action types)
  • Email send logging with open tracking
  • Request logging in production (IP + user agent)
  • Error tracking and alerting
  • Performance monitoring via Vercel Speed Insights
  • Security event correlation and analysis
  • 90-day log retention for compliance

A10:2025 - Request Forgeries​

Status: ✅ Protected

  • CORS properly configured with allowed origins
  • SameSite=Strict cookies for session management
  • State parameter in Google OAuth flow
  • CSRF protection via SameSite cookies
  • No cross-origin resource sharing vulnerabilities
  • Input validation for all external requests

Permission Model​

28 Granular Permissions​

Dashboard (4):

  • view_dashboard
  • view_analytics
  • view_audit_logs
  • export_data

Domains (4):

  • manage_domains
  • create_domain
  • edit_domain
  • delete_domain

Enrollments (3):

  • manage_enrollments
  • approve_enrollment
  • review_milestones

Certificates (5):

  • manage_certificates
  • issue_certificate
  • revoke_certificate
  • manage_templates
  • edit_template

Coupons (4):

  • manage_coupons
  • create_coupon
  • edit_coupon
  • delete_coupon

Announcements (3):

  • manage_announcements
  • create_announcement
  • edit_announcement

IAM (3):

  • manage_users
  • manage_roles
  • manage_permissions

Security Best Practices​

For Developers​

  1. Never commit secrets — Use .env files, never commit .env
  2. Validate all inputs — Even if client-side validation exists
  3. Use parameterized queries — Always use Supabase client methods
  4. Check permissions — Even for simple operations
  5. Log important actions — Admin operations, payment verification, etc.
  6. Use HTTPS — Always in production
  7. Update dependencies — Run npm audit regularly
  8. Review dependencies — Before adding new ones

For Operations​

  1. Rotate secrets — Every 90 days recommended
  2. Monitor activity — Check admin_activity_logs regularly
  3. Backup data — Daily automated backups via Supabase
  4. Update software — Apply security patches immediately
  5. Monitor logs — Set up alerts for errors and anomalies
  6. Test disaster recovery — Monthly backup restoration tests
  7. Access control — Principle of least privilege
  8. Audit trails — Keep for at least 1 year

For Users​

  1. Use strong passwords — 8+ chars, mixed case, numbers
  2. Enable OAuth — When available for convenience
  3. Don't share credentials — Each user gets unique login
  4. Review certificates — Verify on public verification page
  5. Report issues — Security vulnerabilities to info@nssoftwaresolutions.in

Vulnerability Disclosure​

Reporting Security Issues​

Do not open public issues for security vulnerabilities.

Instead:

  1. Email: security@nssoftwaresolutions.in
  2. Include description, steps to reproduce, impact
  3. Allow 48 hours for acknowledgment
  4. Receive update on fix timeline
  5. Coordinated disclosure once patched

Compliance Standards​

Data Protection​

  • GDPR: Right to deletion, data portability implemented
  • Privacy Policy: Available at /privacy
  • Terms of Service: Available at /terms

Financial​

  • PCI DSS: Razorpay handles payment processing
  • Tax Compliance: GST calculation (18% India standard)

Audit & Logging​

  • Activity Logs: 28 action types, IP + user agent logged
  • Email Logs: Send status, open tracking, error logging
  • Retention: Activity logs kept for 1 year, email logs for 90 days

Incident Response​

Response Plan​

  1. Detection — Alerts triggered, manual investigation
  2. Containment — Isolate affected systems
  3. Investigation — Root cause analysis
  4. Remediation — Fix vulnerability
  5. Recovery — Restore normal operations
  6. Post-Incident — Review and improve

Incident Categories​

CategoryResponse TimeEscalation
Critical (data breach)1 hourImmediate
High (service down)2 hoursASAP
Medium (feature broken)4 hoursNext business day
Low (minor issue)1 dayWhen convenient

Testing & Validation​

Security Testing​

  • OWASP Top 10 testing
  • Dependency scanning with npm audit
  • Code review for security issues
  • Penetration testing (external annual)

Automated Testing​

# Check for vulnerabilities
npm audit

# Update audit database
npm audit fix

# Check dependencies
npm outdated

Environment Security​

Production Environment​

NODE_ENV=production
NEXT_PUBLIC_BASE_URL=https://internships.nssoftwaresolutions.in

Security checks:

  • No debug logging
  • Error details hidden from users
  • HTTPS enforced
  • CORS restricted to known origins

Development Environment​

NODE_ENV=development
NEXT_PUBLIC_BASE_URL=http://localhost:3000

Security checks:

  • No production credentials
  • Use test data only
  • Never connect to production database

Secrets Management​

Environment Variables​

Never commit these to version control:

  • JWT_SECRET — Application JWT signing key
  • SUPABASE_SERVICE_ROLE_KEY — Database admin key
  • CRON_SECRET — Cron job authorization
  • RAZORPAY_KEY_SECRET — Payment gateway secret
  • CLOUDINARY_API_SECRET — File storage secret
  • GOOGLE_CLIENT_SECRET — OAuth secret
  • EMAIL_PASS — SMTP password

Rotation Schedule​

  • JWT_SECRET: Every 90 days
  • API Keys: Every 180 days
  • Passwords: Every 90 days
  • Tokens: Automatic (refresh tokens)

Security Checklist​

  • All environment variables configured
  • HTTPS enabled in production
  • Rate limiting tested
  • Authentication flows tested
  • Authorization checks verified
  • Sensitive data encrypted
  • Logs configured
  • Backups scheduled
  • Disaster recovery tested
  • Security audit completed
  • Dependencies updated
  • Secrets rotated
  • Incident response plan documented
  • Team trained on security policies

Security Resources​

Contact​

For security questions or to report vulnerabilities: