Security Knowledge Base
Documented security architecture, design decisions, control implementations and change history for kiranregmi.com. Updated as the platform evolves.
Security Score
JWT Authentication
JSON Web Tokens for stateless session management. Tokens signed with HS256, short expiry (1h access / 7d refresh), stored in httpOnly cookies.
Role-Based Access Control
Three-tier RBAC — Admin, User, Guest. Middleware validates role on every protected route. Least-privilege principle enforced at API level.
HTTPS / TLS Enforcement
All traffic encrypted in transit via TLS 1.2+. HTTP requests automatically redirected to HTTPS. Managed by Vercel CDN edge network.
API Rate Limiting
Express rate-limiter on all API endpoints. Login endpoint hardened to 10 attempts per 15 minutes per IP. Returns 429 on breach.
Internal Audit Logging
Structured event logging for all auth events, protected page access, admin actions. Logs stored in SQLite with timestamp, IP, user agent, outcome.
Input Validation & Sanitization
Server-side validation on all form inputs. HTML entities escaped to prevent XSS. No raw SQL — parameterized queries only.
Security Headers (Helmet.js)
Helmet.js middleware on Express server applies CSP, X-Frame-Options, HSTS, X-Content-Type-Options, and Referrer-Policy headers.
CORS Policy
Cross-Origin Resource Sharing configured to allowlist only kiranregmi.com origins. Wildcard origin (*) explicitly disabled on all API routes.
Password Hashing (bcrypt)
Passwords hashed with bcrypt at cost factor 12. Plaintext passwords never stored or logged. Hash comparison uses timing-safe methods.
Secret Management
All secrets (JWT secret, DB credentials, API keys) stored as environment variables in Render. No secrets in source code or git history.
Form Security (Web3Forms)
Contact form uses Web3Forms API — no direct email credentials exposed. Honeypot field enabled for bot detection. Server-side validation on submit.
Dependency Vulnerability Scanning
npm audit on every deploy. Working toward automated GitHub Dependabot alerts for known CVEs in Node.js dependencies.
Audit Logging & Event Tracking
SQLite-backed audit log captures all auth events — logins, logouts, failed attempts, token expiry, access denials — with role, IP, user-agent, and endpoint. Admin dashboard provides live log viewer with filtering, pagination, and 30-second auto-refresh.
Cloudflare WAF
Cloudflare Web Application Firewall deployed in front of kiranregmi.com. Filters all incoming HTTP traffic at the edge before it reaches Vercel or Render. Custom rate limiting rule blocks brute force on /api/auth/login — 5 requests per 10 seconds per IP triggers a block.
DDoS Protection (Layers 3/4/7)
Cloudflare's always-on DDoS protection absorbs and mitigates volumetric attacks at the network, transport, and application layers. No configuration required — active from the moment traffic routes through Cloudflare's global edge network.
Bot Fight Mode & AI Labyrinth
Bot Fight Mode challenges known malicious bots using JS detection. AI Labyrinth adds invisible nofollow links with AI-generated content to trap and waste resources of bots that ignore crawling standards. AI training crawlers are blocked entirely.
Edge Security Headers (Cloudflare)
Security headers injected at Cloudflare's edge on all responses — applied before content reaches the browser. Headers: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), geolocation=().
Cloudflare Proxy & Origin Masking
All DNS records proxied through Cloudflare (orange cloud enabled). Origin server IP (Vercel/Render) is never exposed to the public internet — attackers cannot bypass WAF by targeting the origin directly. SSL set to Full (strict) for end-to-end encryption verification.
Every meaningful security decision made during site development — what was implemented, why it was chosen, and what risk it mitigates.
Traced and resolved a multi-layer failure in the live threat map. Root cause #1: Vercel had no proxy config — all /api/* calls returned 404 because Vercel served them as static files rather than forwarding to Render. Fixed by creating vercel.json with a rewrite rule proxying /api/(.*) to the Render backend. Root cause #2: Render was running a stale deployment that pre-dated the cloudflareRoutes.js file — forced manual redeploy. Root cause #3: Cloudflare API token had been deleted; recreated with correct Zone Analytics Read + Firewall Services Read permissions scoped to kiranregmi.com. Rebuilt the threat map UI to v3.0 using D3.js with a real Natural Earth projection, replacing the hand-drawn SVG paths with accurate TopoJSON country data.
Skills demonstrated: Multi-layer debugging (CDN → proxy → backend → external API), principle of least privilege token scoping, API permission management, full-stack troubleshooting workflow.
Moved kiranregmi.com nameservers from Spectrum Business (adns.cs.siteprotect.com) to Cloudflare (athena.ns.cloudflare.com / yoxall.ns.cloudflare.com). All traffic now proxied through Cloudflare's edge network. Within the first hour, Cloudflare began detecting and mitigating live malicious traffic including bot scans and automated attack attempts — confirming the WAF is actively filtering real threats.
Risk mitigated: Unfiltered malicious traffic reaching origin; origin IP exposure; DDoS vulnerability; bot scraping.
Created Cloudflare rate limiting rule on /api/auth/login: block any IP exceeding 5 requests per 10 seconds. This adds a second layer on top of the existing express-rate-limit middleware on Render — attacks are now stopped at the edge before consuming any backend resources. Decision: chose IP-based blocking to avoid username enumeration via account lockout behavior.
Risk mitigated: Brute force credential attacks; credential stuffing; backend resource exhaustion from automated login attempts.
Enabled Bot Fight Mode (JS detection challenges malicious bots), AI Labyrinth (traps scrapers with fake AI-generated content), and blocked all AI training crawlers. Added four security headers at the edge via Cloudflare Transform Rules: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy restricting camera/mic/geolocation. Headers applied globally on all responses before reaching the browser.
Risk mitigated: Clickjacking; MIME sniffing attacks; referrer data leakage; unauthorized device access; malicious bot scraping and AI content theft.
Fixed circular logging bug where viewing the audit log was generating its own ADMIN_ACTION entries, polluting the event stream. Removed self-logging from the GET /api/admin/logs endpoint. Added 30-second auto-refresh to the admin viewer with a "Last updated" timestamp indicator so logs stay current without manual page reload.
Risk mitigated: Log pollution masking real security events; analyst fatigue from stale data.
Extended RBAC with per-user permissions array in users.json. Each user is now assigned a specific list of accessible tools (soc-mastery, 7dayai, kids, job-tracker, appointments etc.) rather than inheriting all tools by role. Dashboard dynamically renders only permitted tool cards — unpermissioned tools are not rendered or accessible.
Risk mitigated: Horizontal privilege escalation; unauthorized access to tools not intended for a user's role.
Identified and resolved a login loop caused by inconsistent localStorage key naming. login.html was saving tokens as "token", "role", "email" while dashboard.html expected "kr_token", "kr_role", "kr_email". Standardized all auth keys to kr_ prefix across login and dashboard. Cleared stale keys from existing sessions.
Risk mitigated: Authentication bypass via stale session tokens; session fixation from mismatched key reads.
Designed internal audit logging system to record all authentication events, protected resource access, and admin actions. Chose SQLite for lightweight persistence on Render's free tier. Log schema includes: event_type, user_id, ip_address, user_agent, timestamp, outcome, metadata.
Risk mitigated: Undetected unauthorized access, inability to investigate security incidents, no audit trail for compliance.
Replaced session-based auth with JWT tokens. Implemented three-tier RBAC (Admin, User, Guest). Protected dashboard, SOC interview platform, and AI mastery pages behind authentication middleware. Tokens stored in httpOnly cookies to prevent XSS-based token theft.
Risk mitigated: Unauthorized access to protected educational content, credential theft via XSS, privilege escalation.
Added express-rate-limit middleware to /api/auth/login. Threshold: 10 attempts per 15 minutes per IP. Returns 429 Too Many Requests with Retry-After header. Decision: chose IP-based over account-based to prevent username enumeration via lockout behavior.
Risk mitigated: Brute force credential attacks, credential stuffing, automated login enumeration.
Integrated Helmet.js on Express backend. Configured Content-Security-Policy to allowlist known CDNs (Tailwind, FontAwesome, Google Fonts). Enabled HSTS with 1-year max-age. Set X-Frame-Options: DENY to prevent clickjacking.
Risk mitigated: Clickjacking, MIME-type sniffing, cross-site scripting via policy enforcement, protocol downgrade attacks.
Moved all credentials and API keys to Render environment variables. Audited git history for any accidentally committed secrets (none found). Created .env.example template with placeholder values only. Added .env to .gitignore verification.
Risk mitigated: Credential exposure via public git repository, secrets in deployment logs.
Node.js/Express backend deployed to Render.com. Verified automatic TLS certificate provisioning. Confirmed HTTP to HTTPS redirect active. Set up health check endpoint for uptime monitoring. Frontend on Vercel with edge CDN.
Risk mitigated: Unencrypted data in transit, man-in-the-middle attacks, insecure API communication.
Full Audit Logs & Technical Details
Security controls mapped to the NIST Cybersecurity Framework 2.0 functions — demonstrating framework-aware security thinking.
Govern
Security policy, roles, RBAC, secret management strategy, this knowledge base.
Identify
Asset inventory (Vercel + Render), dependency audit, attack surface mapping.
Protect
JWT auth, bcrypt, RBAC, HTTPS/TLS, Helmet headers, input validation, CORS.
Detect
Audit logging (active), rate-limit alerts, failed auth monitoring, anomaly detection.
Respond
Incident response plan (documented), IP block capability, account suspension workflow.
Recover
Vercel/Render rollback capability, Vercel deployment history, environment variable backups.
Want to discuss this security architecture?
Available to walk through any decision, trade-off or implementation detail in an interview setting.