1. Security posture in this build
- Salted scrypt password derivation for the local pilot account store.
- HttpOnly, SameSite session cookies, with Secure enabled under HTTPS production mode.
- CSRF tokens and exact-origin checks for state-changing account/billing requests.
- Registration/login rate limiting and temporary account lockout.
- High-entropy invitation tokens and server-side plan/role enforcement.
- Content Security Policy, frame restrictions, MIME sniffing protection and restrictive browser permission policy.
- HMAC-hashed IP evidence in audit events rather than raw IP storage in the audit table.
2. Production requirements
Public launch still requires permanent HTTPS hosting, managed secrets, database backups, dependency monitoring, log monitoring, managed SFU/TURN, incident response, restore testing, access reviews and independent penetration/security testing.
3. Responsible disclosure
If you believe you found a vulnerability, email info@bringlivedigital.com with a concise description, affected URL/function, reproduction steps and impact. Do not access other users' information, destroy data, run denial-of-service tests or publicly disclose an unremediated vulnerability.
4. Security incidents
Production incident handling must preserve evidence, contain the issue, evaluate affected information, restore safely and make required notifications. POPIA security-compromise requirements must be incorporated into the final incident procedure.
5. No absolute guarantee
Security controls reduce risk; they do not make an internet service invulnerable. Marketing must not claim guaranteed security or regulatory approval without evidence.