XnoleXDocs

Security

This page documents the security measures implemented in the XnoleX platform. XnoleX is built with security-first principles across authentication, data protection, and infrastructure hardening.

Warning
XnoleX does not hold SOC 2, ISO 27001, GDPR compliance, HIPAA, or penetration testing certifications. Do not claim otherwise in documentation or communications.

Authentication

XnoleX uses RS256 (RSA Signature with SHA-256) for JWT token signing with RSA 2048-bit keys. This asymmetric algorithm ensures tokens cannot be forged without the private key.

  • Access tokens expire after 15 minutes
  • Refresh tokens expire after 7 days
  • Refresh token rotation prevents token reuse
  • Maximum 5 concurrent refresh token sessions per user
  • Oldest session is automatically revoked when limit is exceeded

Password Security

Passwords are hashed using bcrypt via the passlib library with automatic salting. Plaintext passwords are never stored, logged, or transmitted after the initial hashing step. Minimum password length is 12 characters.

API Key Security

API keys follow the format xnk_{token} and are stored as SHA-256 hashes. The plaintext key is only returned once at creation time and is never persisted. Keys support optional expiration and granular permission scoping.

API Key Format:  xnk_{random_token}
Storage:         SHA-256 hash only
Permissions:    ["read", "scan"]
Expiration:     Optional (expires_in_days)

Authorization

Role-based access control is enforced at the API level. Two roles exist: admin anduser. All resources (targets, scans, schedules, notifications, API keys) are ownership-scoped — queries are always filtered to the authenticated user.

Admin users can bypass tier limits, manage other users, and access the billing dashboard.

Rate Limiting

Rate limiting uses a Redis-backed sliding window algorithm applied per user. Limits are enforced per subscription tier and return 429 Too Many Requests when exceeded.

When Redis is unavailable, the system gracefully falls back to allow requests without rate limiting rather than blocking legitimate traffic.

Security Headers

All API responses include the following security headers:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: no-store

CORS

Cross-Origin Resource Sharing (CORS) is restricted to known origins:

  • xnolex.com
  • app.xnolex.com
  • localhost (development)

Tier Enforcement

A middleware layer enforces subscription tier limits before operations are executed. This includes scan count limits, target limits, and concurrent scan limits. Admin users bypass these checks.

Data Isolation

All database queries are scoped to the authenticated user. There is no mechanism for a user to access another user's data through the API. Ownership checks are applied at the query level, not just the endpoint level.

Audit Logging

The following actions are logged for security and compliance purposes:

  • Login and logout events
  • Token refresh operations
  • Profile changes
  • Password changes
  • User management actions (admin operations)

Internal Authentication

Server-to-server communication within the XnoleX infrastructure uses HMAC-based shared secrets. This ensures internal services can authenticate each other without exposing user-facing credentials.