SECURITY.md

# Security Policy & Implementation Details (Scoinvestigator)

This document outlines the security features, updates, policies, and vulnerability reporting procedures for the Scoinvestigator SaaS platform backend.

## 🛡️ Implemented Security Measures

The following security systems have been integrated into the Scoinvestigator production environment:

### 1. Strict Cross-Origin Resource Sharing (CORS)
To prevent unauthorized domains from invoking K2 Think backend endpoints:
- The `ALLOWED_ORIGINS` middleware setting is restricted strictly to authorized production and staging hosts.
- **Allowed Hosts:**
  - `https://www.scoinvestigator.com`
  - `https://scoinvestigator.com`
  - `https://ai-scientific-coinvestigator-ui.vercel.app` (Staging UI)
  - `http://localhost:3000` (Local Frontend Development)

### 2. IP-Based Rate Limiting (SlowAPI)
To protect the AI analysis pipeline from brute-force exploitation and API cost flooding, IP-based request limits are enforced globally:
- **Authentication & Onboarding:**
  - `/api/v1/users/login` — Maximum `5 requests per minute` per IP.
  - `/api/v1/users/register` — Maximum `3 requests per minute` per IP.
- **AI Processing Engine:**
  - `/api/v1/analysis/{project_id}` (Core K2 Engine Trigger) — Maximum `2 requests per minute` per IP.

Exceeding these limits triggers an automatic `HTTP 429 Too Many Requests` response.

---

## 🔒 Vulnerability Reporting

If you discover a security vulnerability in this project, please report it immediately:
- **Contact:** Send an email to [soumanadama93@gmail.com](mailto:soumanadama93@gmail.com).
- Please do not open public GitHub issues for security vulnerabilities.

---

## 🛠️ Security Configuration Updates

All future security hardening updates (CSP headers, token encryption, database SSL config) should be documented here to maintain a clean production trail.