Skip to main content

Platform Security Policy

Overview​

This policy specifies baseline security controls, password requirements, rate-limiting policies, and secret management guidelines across the Learnille platform.

🛡 Security Rules & Best Practices​

1. Password & Authentication Strength​

  • Length & Complexity: Passwords must be a minimum of 8 characters, containing at least 1 uppercase letter, 1 number, and 1 special character.
  • Hashing Standard: Password hashes generated using Argon2id with recommended memory and iteration parameters.

2. Rate Limiting & Abuse Prevention​

  • Auth Endpoints (/auth/login, /auth/forgot-password, /withdrawals/request): Limited to 5 requests per minute per IP via NestJS @ThrottlerGuard.
  • Public Endpoints: Limited to 100 requests per minute per IP.

3. Secret Management​

  • Zero Credentials in Codebase: API keys, database credentials, JWT secrets, and payment webhooks MUST be loaded exclusively via environment variables (.env).
  • Secret Rotation: Database and payment webhook secrets rotated every 90 days.