Security is not a feature we added late. It is how the platform is built. This page describes the measures protecting your account and your data, what you can do on your side, and how to report a vulnerability if you find one.
How we protect your data
HTTPS everywhere
All traffic between your device and our servers is encrypted using TLS 1.2 or higher. Plain HTTP requests are automatically redirected to HTTPS. HTTP Strict Transport Security (HSTS) is enforced so your browser never falls back to an insecure connection.
Password security
Passwords are never stored in plain text. We use bcrypt with a high work factor (cost 12) to hash every password before it reaches our database. This means even if our database were compromised, passwords would remain computationally infeasible to crack.
Short-lived session tokens
Authentication is handled with JSON Web Tokens (JWT). Access tokens expire in 15 minutes; refresh tokens expire in 7 days. Both are stored exclusively in HttpOnly, Secure, SameSite=Strict cookies - inaccessible to JavaScript, protecting you from cross-site scripting (XSS) attacks.
Multi-factor authentication
We support email-based one-time codes (OTP) as a second factor during login. Enabling MFA significantly reduces the risk of account compromise even if your password is leaked.
Rate limiting
All API endpoints are rate-limited via Redis-backed throttling. Login and password-reset endpoints have stricter limits to prevent brute-force and credential-stuffing attacks.
Input sanitisation
Every piece of user-supplied input is validated with class-validator DTOs on the backend and sanitised by a global middleware before processing. This protects against injection attacks and cross-site scripting (XSS).
Database security
Our MongoDB database uses encryption at rest (AES-256) and in transit (TLS). Role-based access control ensures that only the application service account can read or write data. Admin access requires multi-factor authentication and IP allowlisting.
Secret management
All secrets - API keys, database credentials, JWT signing keys - are managed via environment variables and CI/CD secret stores. They are never hard-coded in source code or committed to version control.
Security headers
Our API server uses Helmet.js to set a strict Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Our Next.js frontend applies matching security headers via next.config.js.
Dependency auditing
We pin all package versions explicitly and run automated vulnerability audits (pnpm audit) on every build. Critical security updates are applied within 48 hours of disclosure.
How you can stay safe
- Use a strong, unique password that you do not reuse on any other service.
- Enable Multi-Factor Authentication (MFA) in your account settings.
- Be wary of phishing emails. We will never ask for your password by email or message.
- Keep your app and device up to date so you receive security patches.
- Sign out when you finish on a shared or public device.
Responsible disclosure
If you believe you have found a security vulnerability, tell us before you tell anyone else.
Email support@toofreshtowaste.com with the subject line Security Vulnerability Report. Describe the vulnerability in detail - include steps to reproduce, potential impact, and any supporting screenshots or proof-of-concept code.
Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it (typically 90 days).
Our commitment
- We will acknowledge your report within 3 business days.
- We will keep you informed as we investigate and fix the issue.
- We will not take legal action against researchers who report vulnerabilities in good faith and follow this policy.
- We recognise reporters publicly (with their consent) once a fix has been deployed.
Out of scope
- Denial-of-service (DoS/DDoS) attacks
- Social engineering or phishing of our employees
- Attacks requiring physical access to a user’s device
Security contact
Too Fresh To Waste - Security Team. Reach us at support@toofreshtowaste.com.