Introduction

Cypht takes security seriously at every level - from browser interactions to server-side operations and development practices. Learn about our comprehensive security measures and how we protect your data.

Found a Flaw in Cypht?

We want to hear from you! Help us keep Cypht secure by reporting any security issues you discover.

How to Report Security Issues

Drop by the Cypht Gitter channel or use our private security reporting channels. We take security seriously and promise :

In the Browser

Client-side security measures that protect users during their web sessions and prevent common browser-based attacks.

Session & Cookie Protection

Request & Attack Protection

Security Headers

Comprehensive security-related HTTP headers are implemented :

• X-XSS-Protection : Enables browser cross-site scripting filters
• X-Content-Type-Options : Prevents MIME-type sniffing attacks
• X-Frame-Options : Protects against clickjacking attacks
• Content-Security-Policy : Defines approved content sources

Integrity Verification

Authentication Security

On the Server

Server-side security measures that protect data at rest, secure communications, and prevent unauthorized access.

Secure Connections

Data Encryption

Encryption Methods

All cryptographic operations follow these standards :

• Primary : libsodium when available (preferred implementation)
• Fallback : AES-256-CBC with encrypt-then-MAC
• Key Derivation : PBKDF2 via OpenSSL (Mcrypt is never used)
• For local DB authentication : PBKDF2 with salt, or Argon2 when using libsodium

Server Hardening

Authentication Methods

Privacy Verification

During Development

Security-focused development practices that ensure code quality and prevent vulnerabilities from being introduced.

Secure Coding Practices

Secure Architecture

Global Security Measures

Testing & Coverage

Security Best Practices

Recommendations for users and administrators to maintain optimal security when using Cypht.

For Users

For Administrators