Security
This page documents the security measures implemented in the XnoleX platform. XnoleX is built with security-first principles across authentication, data protection, and infrastructure hardening.
Authentication
XnoleX uses RS256 (RSA Signature with SHA-256) for JWT token signing with RSA 2048-bit keys. This asymmetric algorithm ensures tokens cannot be forged without the private key.
- Access tokens expire after 15 minutes
- Refresh tokens expire after 7 days
- Refresh token rotation prevents token reuse
- Maximum 5 concurrent refresh token sessions per user
- Oldest session is automatically revoked when limit is exceeded
Password Security
Passwords are hashed using bcrypt via the passlib library with automatic salting. Plaintext passwords are never stored, logged, or transmitted after the initial hashing step. Minimum password length is 12 characters.
API Key Security
API keys follow the format xnk_{token} and are stored as SHA-256 hashes. The plaintext key is only returned once at creation time and is never persisted. Keys support optional expiration and granular permission scoping.
API Key Format: xnk_{random_token}
Storage: SHA-256 hash only
Permissions: ["read", "scan"]
Expiration: Optional (expires_in_days)Authorization
Role-based access control is enforced at the API level. Two roles exist: admin anduser. All resources (targets, scans, schedules, notifications, API keys) are ownership-scoped — queries are always filtered to the authenticated user.
Admin users can bypass tier limits, manage other users, and access the billing dashboard.
Rate Limiting
Rate limiting uses a Redis-backed sliding window algorithm applied per user. Limits are enforced per subscription tier and return 429 Too Many Requests when exceeded.
When Redis is unavailable, the system gracefully falls back to allow requests without rate limiting rather than blocking legitimate traffic.
Security Headers
All API responses include the following security headers:
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: no-storeCORS
Cross-Origin Resource Sharing (CORS) is restricted to known origins:
xnolex.comapp.xnolex.comlocalhost(development)
Tier Enforcement
A middleware layer enforces subscription tier limits before operations are executed. This includes scan count limits, target limits, and concurrent scan limits. Admin users bypass these checks.
Data Isolation
All database queries are scoped to the authenticated user. There is no mechanism for a user to access another user's data through the API. Ownership checks are applied at the query level, not just the endpoint level.
Audit Logging
The following actions are logged for security and compliance purposes:
- Login and logout events
- Token refresh operations
- Profile changes
- Password changes
- User management actions (admin operations)
Internal Authentication
Server-to-server communication within the XnoleX infrastructure uses HMAC-based shared secrets. This ensures internal services can authenticate each other without exposing user-facing credentials.