Security Policy

1. Security Overview

DevelopedByGolds takes security seriously. This document describes the technical and organizational measures we employ to protect your account and data across the DBG Ecosystem.

Our security architecture is built on the principles of defense in depth, least privilege, and zero trust.

2. Authentication & Session Security

• Firebase Authentication: Industry-standard OAuth 2.0 and email/password authentication managed by Google Firebase
• HttpOnly Session Cookies: The dbg_sso session cookie is set with HttpOnly, Secure, and SameSite=Lax attributes via server-side HTTP headers, preventing JavaScript-based token theft
• Token Expiry: Session tokens expire after 55 minutes and are automatically refreshed while you are active
• Single-Use SSO Tokens: Cross-domain authentication tokens are single-use with 30-second expiry windows
• Brute-Force Protection: Account lockout after 5 failed login attempts within 15 minutes
• Session Revocation: You can revoke all active sessions from your Security dashboard at any time
• Emergency Lockdown: Instantly terminate all sessions across all devices from your dashboard

3. Transport Security

• HTTPS Enforcement: All DBG domains force HTTPS via 301 redirects. HTTP traffic is never served.
• HSTS: Strict-Transport-Security header with max-age=63072000; includeSubDomains; preload ensures browsers never connect over HTTP
• TLS 1.3: All connections are encrypted using TLS 1.3 (the latest and most secure version)
• Certificate Transparency: SSL certificates are logged to public CT logs for accountability

4. Content Security Policy (CSP)

All DBG domains are protected by strict Content Security Policies that:

• Restrict script execution to 'self' and whitelisted Firebase/Google domains only
• Block 'unsafe-inline' and 'unsafe-eval' in script-src directives
• Prevent framing of DBG pages (frame-src 'none')
• Restrict form submissions to same-origin
• Enforce upgrade-insecure-requests for all resources

5. Data Protection

• Encryption at Rest: All Firestore data is encrypted using AES-256
• Encryption in Transit: All data is transmitted over TLS 1.3
• Access Control: Firestore Security Rules enforce that users can only read/write their own data
• No Password Storage: Passwords are hashed and salted by Firebase Authentication — DBG never has access to your plaintext password
• Data Isolation: Each user's data is completely isolated via Firebase UID-based access control

6. Security Headers

All DBG domains deploy the following security headers:

• X-Frame-Options: DENY — Prevents clickjacking
• X-Content-Type-Options: nosniff — Prevents MIME-type sniffing
• X-XSS-Protection: 1; mode=block — Enables browser XSS filter
• Referrer-Policy: strict-origin-when-cross-origin — Limits referrer information
• Permissions-Policy — Disables camera, microphone, geolocation, and payment APIs

7. Vulnerability Reporting

If you discover a security vulnerability in any DBG application, we encourage responsible disclosure:

• Email: security@developedbygolds.qzz.io
• Do NOT disclose the vulnerability publicly until we have addressed it
• We will acknowledge your report within 48 hours
• We will work with you to understand and resolve the issue
• We do not offer financial bounties, but we will credit researchers who follow responsible disclosure

8. Incident Response

In the event of a security incident:

• We will investigate and contain the incident immediately
• Affected users will be notified within 72 hours via email and in-app notification
• We will provide a clear description of what happened, what data was affected, and what steps we are taking
• We will implement measures to prevent recurrence

9. Changes to This Policy

We may update this Security Policy periodically. Material changes will be communicated to all users.

10. Contact

For security inquiries, contact us at security@developedbygolds.qzz.io