// SECURITY
SECURITY
Last updated: June 7, 2026
SECURITY IS A CORE PRINCIPLE, NOT AN AFTERTHOUGHT
TABLE OF CONTENTS
1. SECURITY OVERVIEW
BetterAuth is built from the ground up with security as a foundational principle. As a software licensing and authentication platform, we understand that our customers trust us with sensitive data — license keys, user information, and application integrity. We take that trust seriously.
Our security posture encompasses:
- Encryption at rest and in transit for all data stored and transmitted through our platform.
- Strict access controls with Row Level Security (RLS) enforcing data isolation between accounts.
- Two-factor authentication (2FA) available for all accounts and mandatory for administrative access.
- Rate limiting and abuse detection to protect against brute-force attacks and automated abuse.
- Regular security reviews of our codebase, dependencies, and infrastructure configurations.
- Principle of least privilege applied to all system components and personnel access.
2. DATA ENCRYPTION
In Transit:
- All communications between clients and our servers are encrypted using TLS 1.2 or higher.
- API endpoints enforce HTTPS — plain HTTP connections are rejected.
- Certificate pinning is recommended for client integrations.
At Rest:
- Sensitive data in our database is encrypted using AES-256 encryption.
- Encrypted file delivery uses AES-256-CBC with per-file encryption keys.
- Passwords are hashed using bcrypt with adaptive cost factors — never stored in plaintext.
- API keys and secrets are hashed before storage and never returned in full via the API.
Application-Level:
- Session tokens are generated using cryptographically secure random bytes.
- CSRF tokens are validated on all state-changing requests.
- Input sanitization and parameterized queries prevent SQL injection.
3. INFRASTRUCTURE SECURITY
Our infrastructure is designed for resilience and security:
- Cloud Hosting: Our backend runs on Supabase's SOC 2 Type II compliant infrastructure, hosted on AWS with physical data center security.
- Database Security: PostgreSQL with Row Level Security (RLS) policies ensuring strict tenant isolation. Direct database access is not exposed.
- Network Security: Cloudflare provides DDoS mitigation, WAF (Web Application Firewall), and DNS security. Suspicious traffic patterns are automatically filtered.
- Access Control: Production system access is restricted to authorized personnel via SSH key-based authentication with 2FA. All access is logged and audited.
- Monitoring: Continuous monitoring of system health, error rates, and anomalous activity. Automated alerts for security-relevant events.
- Patching: Dependencies and system components are updated promptly upon the release of security patches.
4. RESPONSIBLE DISCLOSURE POLICY
We value the security research community and encourage responsible disclosure of vulnerabilities. If you believe you have discovered a security vulnerability in BetterAuth, we ask that you:
- Report privately by emailing [email protected] — do not disclose the vulnerability publicly until we have resolved it.
- Provide sufficient detail to allow us to reproduce and verify the vulnerability, including steps, affected endpoints, and potential impact.
- Allow reasonable time — we commit to acknowledging your report within 48 hours and providing a status update within 5 business days.
- Avoid data destruction — do not access, modify, or delete other users' data. Minimize the impact of your testing.
- Act in good faith — do not exploit the vulnerability for personal gain or to cause harm.
We commit to:
- Acknowledging reports within 48 hours.
- Providing regular status updates on remediation progress.
- Notifying you when the vulnerability has been resolved.
- Crediting researchers (with permission) in our security advisories.
5. BUG BOUNTY PROGRAM
We operate a bug bounty program to reward security researchers who help us keep BetterAuth secure. Rewards are based on severity and impact:
Critical
$500+
RCE, data breach, auth bypass
High
$200–$500
Privilege escalation, injection
Medium
$50–$200
XSS, CSRF, info disclosure
Low
$25–$50
Config issues, best practices
In scope:
- betterauth.online and all subdomains
- API endpoints (api.betterauth.online and /api/ routes)
- Authentication and session management
- License validation and key generation systems
- File delivery and encryption mechanisms
Out of scope:
- Social engineering or phishing attacks
- Denial of Service (DoS/DDoS) — report via email but no bounty
- Third-party services (Supabase, Cloudflare) — report to them directly
- Issues already reported by another researcher
Submit reports to [email protected] with full reproduction steps. Bounties are paid via PayPal or cryptocurrency at the researcher's preference.