How your files are protected
Your translation files#
- The list of files, the manifest, carries a digital signature. The loader checks it against your public key. An unsigned or altered manifest is refused, and the page keeps what it had.
- Each language file is checked against a checksum in the signed manifest. A changed file is refused.
- A version older than one already accepted is refused, so an old file cannot be put back.
- Every site has its own signing key. If one key were stolen, only that site is affected. You can list two public keys while a key is being replaced.
- The private signing key stays with the platform. At first it is held by the application, encrypted. The plan is to move it to a dedicated key service before the product grows. The decision is recorded as D29.
Your account#
- Passwords need 15 to 128 characters and are stored as slow hashes.
- Owners and admins must use two-factor sign-in.
- Sign-in attempts are slowed down, for known and unknown addresses alike.
- Sessions end after 30 minutes without activity and after 8 hours in total.
- Secret API keys are stored as hashes and shown once.
- Every account can reach only its own data. A key for one account cannot touch another.
What we log#
Important actions go to your audit log. Support sessions are read-only, need a reason and appear in your log.
Not yet done#
- No independent security audit has been made: OPEN.
- The address for reporting a vulnerability is not set up: OPEN.
- Several parts have been tested only against test databases and fake services, not against the real systems. Nothing is deployed.