Security at ArcBooks

Last updated: September 9, 2026

ArcBooks is designed with practical safeguards for business accounting data and authentication.

Authentication

• Passwords are hashed with bcrypt before storage.
• Sessions use signed, HTTP-only cookies.
• Password reset invalidates older sessions through a session version.
• Email verification is required before normal sign-in.

Application security

• Input validation is performed on authentication endpoints.
• Authentication and email-token endpoints have request rate limits.
• API responses are configured not to be cached.
• Security headers include frame, MIME-sniffing, referrer, permissions, and cross-origin protections.
• Secrets are loaded from environment variables rather than source code.

Deployment

The included production configuration supports Docker and Render-style deployment, with MongoDB provided through a production connection string and secrets configured as deployment environment variables.

Reporting a security issue

Please report suspected security issues privately to Raghav84299@gmail.com. Do not publicly post credentials, tokens, database connection strings, or other sensitive information.