Security FAQ

Security best practices and frequently asked questions for OpenDev integration.

Authentication Security

Q: How are user credentials stored?

A: OpenDev follows industry best practices:

• Passwords: Never stored directly; OAuth providers handle authentication
• Tokens: Encrypted using AES-256-GCM before storage
• Sensitive data: Encrypted at rest and in transit (TLS 1.3)
• Keys: Stored in secure environment variables, never in code

Q: What authentication methods are supported?

A: Supported authentication methods:

Q: How long are tokens valid?

A: Token validity periods:

• Access tokens: 1 hour (configurable)
• Refresh tokens: 30 days
• Session tokens: 24 hours (configurable)
• API keys: Until revoked

Q: How do I secure my API keys?

A: API key security best practices:

1. Never expose in client code: Use server-side API calls
2. Environment variables: Store keys in .env files
3. Key rotation: Rotate keys periodically
4. Scope limitation: Use keys with minimum required permissions
5. Monitoring: Track API key usage for anomalies

Data Security

Q: Is my data encrypted?

A: Yes, OpenDev uses multiple encryption layers:

• In Transit: TLS 1.3 for all communications
• At Rest: AES-256 encryption for sensitive data
• Database: Encrypted fields for tokens, credentials
• Backups: Encrypted backup storage

Q: What data does OpenDev collect?

A: Data collection is minimal:

Q: How do I comply with GDPR/Privacy regulations?

A: GDPR compliance features:

1. Data export: Users can request their data
2. Data deletion: Right to be forgotten implementation
3. Consent management: Explicit consent for data collection
4. Data minimization: Only collect necessary data
5. Breach notification: 72-hour notification process

Q: Can I request data deletion?

A: Yes, data deletion process:

1. User submits deletion request
2. Verification of identity
3. Data removal within 30 days
4. Confirmation email sent

Application Security

Q: How do I protect against CSRF attacks?

A: CSRF protection measures:

1. State parameter: Always use state in OAuth flows
2. CSRF tokens: Include in forms and AJAX requests
3. SameSite cookies: Use SameSite=Strict attribute
4. Origin validation: Verify request origins

// Example: OAuth with state parameter
const state = generateSecureRandom();
session.oauthState = state;
const authUrl = `${provider}/auth?state=${state}&...`;

Q: How do I prevent XSS vulnerabilities?

A: XSS prevention best practices:

1. Output encoding: Escape all user input before display
2. Content Security Policy: Implement strict CSP headers
3. Input validation: Validate and sanitize all inputs
4. HTTPOnly cookies: Prevent JavaScript access to session cookies

<!-- CSP Header Example -->
Content-Security-Policy: default-src 'self'; 
  script-src 'self' 'unsafe-inline'; 
  style-src 'self' 'unsafe-inline';

Q: What rate limiting is in place?

A: Rate limiting configuration:

Q: How do I secure webhook endpoints?

A: Webhook security measures:

1. Signature verification: Validate HMAC signatures
2. IP whitelisting: Restrict to provider IPs if available
3. HTTPS only: Require TLS for webhook URLs
4. Idempotency: Handle duplicate deliveries safely

// Example: Webhook signature verification
function verifyWebhookSignature(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Infrastructure Security

Q: Where is the data hosted?

A: Infrastructure details:

• Primary: Secure cloud infrastructure (AWS/Aliyun)
• Regions: Multiple availability zones
• Compliance: SOC 2, ISO 27001 certified data centers
• Backups: Daily encrypted backups with 30-day retention

Q: Is the infrastructure monitored?

A: Monitoring includes:

1. Real-time alerts: Anomaly detection
2. Log analysis: Centralized logging with 90-day retention
3. Uptime monitoring: 99.9% SLA
4. Security scanning: Regular vulnerability assessments

Q: How are security incidents handled?

A: Incident response process:

1. Detection: Automated monitoring alerts
2. Analysis: Security team investigation
3. Containment: Immediate threat mitigation
4. Communication: User notification within 72 hours
5. Recovery: System restoration and post-mortem

Compliance & Auditing

Q: What compliance certifications are available?

A: Current certifications:

• SOC 2 Type II
• ISO 27001
• GDPR compliant
• PCI DSS (for payment processing)

Q: How can I audit API access?

A: Auditing capabilities:

1. Audit logs: All API calls logged with timestamps
2. User actions: Track user activities
3. Admin actions: Privileged action logging
4. Export: Download audit logs in CSV/JSON format

Q: How do I report a security vulnerability?

A: Responsible disclosure:

1. Email: contact@zinben.com
2. PGP encryption: Available for sensitive reports
3. Response time: 48-hour acknowledgment
4. Bug bounty: Rewards for valid vulnerability reports

Last updated: January 2026