Security practices
- Encryption in transit: TLS for all public endpoints (dashboard, API, realtime).
- Encryption at rest: OAuth tokens encrypted with AES-256-GCM in the API layer.
- Auth isolation: Control-plane users (dashboard) are separate from SDK end-users (your app).
- Webhook signatures: HMAC-SHA256 on outbound webhook deliveries.
- Rate limiting: IP and API-key limits on the public API.
Reporting vulnerabilities
Please report security issues responsibly to security@paperdb.app. We aim to acknowledge within 48 hours.
Do not file public GitHub issues for undisclosed vulnerabilities.
Self-hosting
When you self-host, you are responsible for network exposure, secret rotation, and database backups. See EC2 deployment docs for hardening guidance.