We actively maintain security patches for the following versions of the platform:

The Practon Alumni Association Platform implements multiple layers of security:

• JWT-based stateless auth with short-lived access tokens (15 min) and rotating refresh tokens (7 days)
• HttpOnly cookie storage for refresh tokens — inaccessible to JavaScript
• Role-based access control (RBAC) with 5 levels: superadmin › admin › moderator › member › user
• bcryptjs password hashing with salt rounds = 12

• Helmet.js — Sets security-critical HTTP headers (XSS Protection, HSTS, X-Frame-Options, CSP, etc.)
• express-rate-limit — 100 requests per 15 minutes per IP on auth endpoints; 50 req/15min on sensitive routes
• CORS whitelist — Only CLIENT_URL and ADMIN_URL are permitted origins
• Zod schema validation — All incoming request bodies are strictly validated
• Input sanitization — Malformed or unexpected fields are rejected before reaching the database

• MongoDB Atlas with IP whitelist restrictions and encrypted at-rest storage
• Cloudinary secure media delivery via signed URLs where applicable
• Environment variable isolation — All secrets stored in .env, never in source code
• No sensitive data in logs — Passwords and tokens are never logged

We take security seriously. If you discover a security vulnerability in this project, please do NOT create a public GitHub Issue. Instead, follow responsible disclosure:

Send a detailed report to:

📧 security@dpian.dev (or info.salahuddinkader@gmail.com)

Please include:

• Description of the vulnerability
• Steps to reproduce (proof-of-concept if possible)
• Affected components, versions, or endpoints
• Potential impact assessment
• Your recommended mitigation (optional)

• Please do not exploit the vulnerability beyond what is necessary for the proof of concept
• Please do not disclose publicly until a fix has been released
• We will work with you collaboratively and give appropriate public credit after the fix

• The admin dashboard URL is intentionally not linked from the public site
• Admin login attempts are rate-limited to prevent brute force attacks
• All admin actions are logged in the database audit log

• .env files must never be committed to version control (enforced by .gitignore)
• MongoDB credentials, JWT secrets, and SMTP passwords are rotated quarterly in production

• Admin notification email address is resolved dynamically from the database, not hardcoded in environment variables
• SMTP credentials use app-specific passwords, not account passwords

Before submitting a pull request, ensure:

• No secrets, API keys, or passwords are committed
• User inputs are validated with Zod schemas on the server
• New routes are protected with appropriate protect and authorize middleware
• File upload handlers validate MIME type and file size limits
• Error messages do not leak sensitive internal information
• New dependencies are reviewed for known CVEs (npm audit)

We thank the following security researchers for responsible disclosure:

No reports yet — be the first!

© 2026 Practon Alumni Association · প্রাক্তন শিক্ষার্থী পরিষদ