SECURITY
Security Policy
Last updated: November 29, 2025
At SCAFFOLD, security is not an afterthought—it’s built into every layer of our platform. This Security Policy outlines the measures we take to protect your data, maintain system integrity, and ensure a secure development environment.
Security at a Glance
ENCRYPTION
All data encrypted in transit (TLS 1.3) and at rest (AES-256)
MONITORING
24/7 security monitoring with automated threat detection
COMPLIANCE
GDPR, CCPA, SOC 2-aligned practices
INCIDENT RESPONSE
Dedicated security team with <1 hour response time
1. Data Encryption
1.1 In Transit
- ✓ TLS 1.3 enforced for all HTTPS connections
- ✓ HSTS enabled to prevent downgrade attacks
- ✓ Certificate pinning for API communications
- ✓ End-to-end encryption for sensitive operations
1.2 At Rest
- ✓ AES-256 encryption for all database records
- ✓ Encrypted backups with separate keys
- ✓ Secure key management using AWS KMS / equivalent
- ✓ Regular key rotation (quarterly minimum)
2. Authentication & Access Control
2.1 User Authentication
- → Bcrypt password hashing (14 rounds minimum)
- → Password requirements: 8+ characters, complexity enforced
- → OAuth 2.0 support for third-party authentication
- → Session management: HTTP-only, secure cookies
- → Account lockout after 5 failed login attempts
2.2 Authorization
- → Role-based access control (RBAC)
- → Project-level permissions (owner, editor, viewer)
- → API key authentication with scoped permissions
- → Principle of least privilege enforced
2.3 API Security
- → Rate limiting: 60 requests/minute per user
- → API key rotation supported
- → Request signing for sensitive operations
- → CORS policies strictly enforced
3. Infrastructure Security
3.1 Hosting & Network
- → Vercel hosting with global CDN and DDoS protection
- → Supabase database with automatic backups
- → Network isolation for production environments
- → WAF (Web Application Firewall) enabled
3.2 Application Security
- ✓ OWASP Top 10 protection
- ✓ SQL injection prevention (parameterized queries)
- ✓ XSS protection (Content Security Policy)
- ✓ CSRF tokens on all state-changing requests
- ✓ Input validation and sanitization
3.3 Dependency Management
- → Automated vulnerability scanning (Dependabot, Snyk)
- → Regular dependency updates
- → Security patch SLA: Critical patches within 48 hours
- → Supply chain security: Package lock files enforced
4. Data Protection
4.1 Data Backups
- ✓ Automated daily backups of all data
- ✓ Point-in-time recovery (PITR) enabled
- ✓ Geo-redundant storage in multiple regions
- ✓ Backup testing: Monthly restore drills
- ✓ Retention: 30-day backup history
4.2 Data Deletion
- → Soft delete: 30-day recovery window
- → Hard delete: Secure erasure after retention period
- → GDPR compliance: Right to be forgotten honored within 30 days
- → Backup purging: Deleted data removed from backups after 90 days
4.3 Data Minimization
- → Collect only necessary data
- → Anonymize analytics data
- → No third-party data sharing without consent
- → Regular data audits to remove unnecessary data
5. Third-Party Security
We carefully vet all third-party services:
6. Monitoring & Logging
- → Real-time security monitoring with automated alerts
- → Audit logs for all sensitive operations
- → Failed login tracking and anomaly detection
- → Log retention: 90 days for security events
- → Incident response: <1 hour for critical issues
7. Vulnerability Management
7.1 Security Testing
- ✓ Automated security scans on every deployment
- ✓ Manual penetration testing annually
- ✓ Code review for security-sensitive changes
- ✓ Static analysis (SAST) integrated in CI/CD
7.2 Responsible Disclosure
We welcome security researchers to report vulnerabilities:
- → Email: owner@specdriver.dev
- → Response SLA: Initial response within 24 hours
- → Resolution SLA: Critical vulnerabilities patched within 48 hours
8. Incident Response
Our incident response process:
STEP 1: DETECTION
Automated monitoring detects anomalies. Security team notified immediately.
STEP 2: CONTAINMENT
Isolate affected systems. Prevent further damage.
STEP 3: REMEDIATION
Patch vulnerabilities. Restore from clean backups if needed.
STEP 4: NOTIFICATION
Notify affected users within 72 hours (GDPR requirement).
9. User Security Best Practices
How you can protect your account:
- ✓ Use a strong, unique password (password manager recommended)
- ✓ Never share your password with anyone, including SCAFFOLD staff
- ✓ Report suspicious activity immediately to owner@specdriver.dev
- ✓ Review your project permissions regularly
- ✓ Log out from shared devices
10. Security Contact
If you notice anything suspicious or have security concerns, please contact our security team immediately:
RESPONSE TIME
Within 24 hours for security reports
GENERAL SUPPORT
Contact FormRELATED POLICIES