Security Policy

Transport & Storage Encryption

• •All traffic to and from Atheryx is encrypted with TLS 1.2+ in transit.
• •Data is encrypted at rest using cloud provider encryption (Google Cloud / Firebase).
• •Application secrets are stored separately from client-visible data and never returned by public API responses.

Authentication & Sessions

• •Passwords are hashed with bcrypt at cost factor 12 before storage.
• •Session tokens are cryptographically random and short-lived.
• •Sessions expire after 7 days of active use or 72 hours of inactivity, whichever comes first.
• •Session refresh requires a refresh token, enabling rotation without re-authentication.

Request Integrity

• •All API endpoints validate the caller's session before processing.
• •Optional HMAC request signing detects tampered or replayed requests.
• •IP whitelisting can restrict API calls to trusted addresses.
• •Rate limiting protects endpoints from brute force and abuse.

Input Handling & Injection Prevention

• •All user-provided strings are sanitized server-side before storage.
• •Firebase Realtime Database rules restrict read/write access at the path level.
• •Webhook payloads and event logs are size-limited and content-filtered.

Access Control

• •Role-based access control (USER, VIP, PREMIUM, MODERATOR, ADMIN, OWNER) gates dashboard actions.
• •Tag permissions provide feature-level authorization independent of roles.
• •Administrative actions are logged with user attribution for audit.

Audit & Monitoring

• •Every sensitive action — login, registration, license activation, HWID reset — is written to an event log.
• •Discord webhook notifications alert on registration and other key events.
• •We investigate anomalous activity and can blacklist hardware or accounts involved in abuse.

Vulnerability Reporting

If you discover a security vulnerability in Atheryx, please report it privately to security@atheryxauth.cc. We ask that you do not disclose the issue publicly until we have had a reasonable opportunity to address it. We recognize responsible disclosures in our changelog with your consent.