Security Policy
How we protect your data and how to report vulnerabilities responsibly.
Vulnerability Disclosure Policy
We take security seriously. If you discover a security vulnerability, we encourage you to report it responsibly using the process below.
Report via Email
security@syriahub.org
48-Hour Response
We acknowledge all reports within 48 hours
Resolution
Timeline provided within 7 days
What to Report
In Scope
- •Authentication and authorization vulnerabilities
- •Data exposure or leakage issues
- •Cross-site scripting (XSS) attacks
- •Server-side request forgery (SSRF)
Out of Scope
- •Denial of service (DoS) attacks
- •Social engineering attacks
- •Physical security issues
Our Commitment
Security Infrastructure
Our platform undergoes regular security reviews. Here are the security measures implemented as of January 2026:
Origin Validation
All mutation endpoints are protected with origin validation to prevent Cross-Site Request Forgery (CSRF) attacks.
Rate Limiting
IP-based rate limiting on all endpoints protects against abuse and brute-force attacks.
Turnstile Verification
Bot protection on public forms with fail-closed behavior in production mode.
Cryptographic Tokens
All public tokens are generated using secure cryptographic functions (gen_random_bytes).
Protected Endpoints
All sensitive endpoints are protected with origin validation and rate limiting: