How FolioSpace is built.

What we build

• Strict Content Security Policy — script-src restricted to 'self' with explicit allow-lists for LinkedIn and Google Analytics.
• HSTS with includeSubDomains and preload opt-in via Strict-Transport-Security header on every response.
• TrustedHost middleware that 404s any request with a non-allow-listed Host header.
• CSRF tokens on every state-changing form, session-bound and server-validated.
• Rate limits via slowapi on login, signup, forgot-password, reset, OAuth callbacks, webhooks, and admin login.
• Argon2/bcrypt password hashing via passlib; OAuth users have a NULL password_hash and are gated by require_user checks.
• Server-side fetch of OG image URLs and avatars through a public-URL allow-list that rejects private IP ranges, embedded credentials, and non-http schemes. DNS is resolved at write time.
• Webhook endpoints exempted from Origin checks but verified via HMAC-SHA256 (Cashfree).
• Database queries are parameterised — no string interpolation into SQL.

What we don't build

• We don't load third-party ad scripts, retargeting pixels, or session-replay tools in your folio or on any logged-in page.
• We don't store card numbers, UPI PINs, or any payment instrument. Cashfree holds the mandate; we store only a subscription ID.
• We don't run a JS framework on the client. Your folio is server-rendered HTML + vanilla JS — there is no React, Vue, or hydration in the page you share.
• We don't sell or share your data. See the privacy policy for the long version.

What we monitor

• Application logs are retained for 30 days on Render free tier; longer retention is on the roadmap.
• Failed login attempts and rate-limit hits are logged with anonymised IPs (last octet zeroed).
• Security headers are tested on every deploy via a smoke test in CI.

Reporting a problem

Found a vulnerability or something that worries you? Email security@foliospace.in. We respond within 72 hours and credit researchers on a public page if you'd like.

We do not run a paid bug bounty yet. This will change once the product reaches steady state.

Open dependencies

FolioSpace is built on FastAPI, Jinja2, psycopg, passlib, slowapi, python-multipart, and httpx for Cashfree Subscriptions API calls. The full dependency tree lives in requirements.txt. Server-rendered templates use vanilla CSS/JS only.