SECURITY.md

Security Policy & Implementation Details (Scoinvestigator)

This document outlines the security features, updates, policies, and vulnerability reporting procedures for the Scoinvestigator SaaS platform backend.

🛡️ Implemented Security Measures

The following security systems have been integrated into the Scoinvestigator production environment:

1. Strict Cross-Origin Resource Sharing (CORS)

To prevent unauthorized domains from invoking K2 Think backend endpoints:

• The ALLOWED_ORIGINS middleware setting is restricted strictly to authorized production and staging hosts.
• Allowed Hosts:
  • https://www.scoinvestigator.com
  • https://scoinvestigator.com
  • https://ai-scientific-coinvestigator-ui.vercel.app (Staging UI)
  • http://localhost:3000 (Local Frontend Development)

2. IP-Based Rate Limiting (SlowAPI)

To protect the AI analysis pipeline from brute-force exploitation and API cost flooding, IP-based request limits are enforced globally:

• Authentication & Onboarding:
  • /api/v1/users/login — Maximum 5 requests per minute per IP.
  • /api/v1/users/register — Maximum 3 requests per minute per IP.
• AI Processing Engine:
  • /api/v1/analysis/{project_id} (Core K2 Engine Trigger) — Maximum 2 requests per minute per IP.

Exceeding these limits triggers an automatic HTTP 429 Too Many Requests response.

---

🔒 Vulnerability Reporting

If you discover a security vulnerability in this project, please report it immediately:

• Contact: Send an email to soumanadama93@gmail.com.
• Please do not open public GitHub issues for security vulnerabilities.

---

🛠️ Security Configuration Updates

All future security hardening updates (CSP headers, token encryption, database SSL config) should be documented here to maintain a clean production trail.