Last updated: 2026-07-20 | Effective: 2026-07-20
Trust
Security Policy
DevStackIO is a privacy-first, browser-based tools platform. This policy describes how we protect user data, our security architecture, and how to report a vulnerability.
Supported Versions
| Version | Supported |
|---|---|
| 0.1.x | Yes |
Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability, please report it privately:
Email: contact@devstackio.com
GitHub Profile: github.com/roddavinod99
Please do not report security vulnerabilities through public GitHub issues.
What to Include
- Type of vulnerability
- Steps to reproduce
- Affected versions
- Potential impact
- Suggested fix (if any)
Response Timeline
- 24 hours: Initial acknowledgment
- 7 days: Assessment and severity determination
- 30 days: Fix deployed (for critical issues)
Security Architecture
Defense in Depth
Layer 1: Nginx Reverse Proxy
- TLS 1.2/1.3
- Rate limiting (3 zones)
- Bad user-agent blocking
- Path traversal blocking
- Attack path blocking (.php, wp-admin, .env, .git)
- Security headers (CSP, HSTS, etc.)
- Request size limits (10 MB)
Layer 2: Next.js Middleware (proxy.ts)
- Application rate limiting
- Security headers
- Request validation
Layer 3: API Routes
- Input sanitization
- Content-Type enforcement
- Origin/Referer validation
- Body size limits
- IP redaction in storage
- Structured logging (no secrets)
Layer 4: Client-Side
- DOMPurify HTML/SVG sanitization
- Content Security Policy enforcement
- Web Worker isolation
- Service Worker (cache-first for assets)
Security Headers
| Header | Purpose |
|---|---|
| Strict-Transport-Security | Enforce HTTPS |
| Content-Security-Policy | XSS prevention |
| X-Content-Type-Options | MIME sniffing prevention |
| X-Frame-Options | Clickjacking prevention |
| Referrer-Policy | Referrer leakage prevention |
| Permissions-Policy | Feature restriction |
| Cross-Origin-Opener-Policy | Cross-origin isolation |
| Cross-Origin-Resource-Policy | Resource isolation |
Data Protection
- No user data stored — All tool processing is client-side
- IP addresses — SHA-256 hashed before storage
- Form submissions — Redacted IPs, auto-purged at 500 entries
- File uploads — Processed in memory only, never persisted
- Logs — No secrets, no PII, no file contents
Security Standards & Compliance
DevStackIO aligns with established web security standards and best practices. The following are publicly verifiable:
| Standard | Status | Verify |
|---|---|---|
| RFC 9116 security.txt | Published at /.well-known/security.txt | Verify |
| HTTP Strict Transport Security (HSTS) | HTTPS-only with preload directive | Verify |
| Transport Layer Security (TLS) | Let's Encrypt certificate, auto-renewing | Verify |
| OWASP Secure Headers | CSP, XFO, COOP, CORP, Referrer-Policy, Permissions-Policy | Verify |
| OWASP Top Ten | Input validation, rate limiting, sanitization | Verify |
| WCAG 2.2 Level AA | Accessibility conformance target | Verify |
Security Checklist
- ✓Environment variables use production values (not defaults)
- ✓.env files are NOT in git tracking
- ✓SSL certificates are valid and auto-renewing
- ✓Rate limiting is enabled (unless behind Cloudflare)
- ✓CSP uses build-time SHA-256 hashes; zero unsafe-inline
- ✓All API inputs are validated and size-limited
- ✓File upload limits are enforced at all layers
- ✓Error messages don't leak internal details
- ✓Dependencies are up to date (npm audit)
- ✓Service worker uses HTTPS
Related Documents
Contact
Questions about this Security Policy? Contact us atcontact@devstackio.com.