Production security

CollabOS production hardening includes request IDs, safe error responses, security headers, strict CORS allowlisting, validation of request DTOs, targeted abuse limits on sensitive routes, and startup checks for unsafe production configuration.

One-time account tokens

New email-verification and password-reset tokens are stored as SHA-256 hashes rather than plaintext. Tokens issued before this hardening release remain temporarily compatible until they are used or replaced.

Passwords

New registrations and password resets require at least eight characters. Existing accounts are not invalidated by this change.

Request IDs

The API returns X-Request-Id. Include this value in support reports when an API request fails. CollabOS logs the request ID without logging request bodies or authorization headers.

Secrets

Do not put real secrets in frontend environment variables, source code, screenshots, exported ZIPs, or public documentation. Provider API keys and server signing credentials belong in backend environment configuration only.

Rate limiting

Sensitive authentication, upload, and public raffle-entry routes have an application-instance rate limit. Developer API keys have a separate API-key rate limit. A production reverse proxy, CDN, WAF, or load balancer should still enforce global/IP limits across all application instances.