Skip to content
Trust

Security

We build a security product, so we hold the dashboard to the standard we'd ask of you.

How the dashboard is built

  • Protected by LightMoon. The dashboard and its API run behind the same library you install, with rate limits on sign-in and a strict Content Security Policy.
  • Passwords are stored as salted PBKDF2-SHA256 hashes. Sign-in attempts are throttled per account and per network.
  • Sessions use random 256-bit tokens in HttpOnly, Secure, SameSite cookies; only a SHA-256 hash is stored. Changing your password signs out every other session.
  • Project keys are stored as hashes and shown once. Rotating a key takes effect immediately.
  • Rule packs are signed with a per-project Ed25519 key. The private key is encrypted with AES-256-GCM at rest; the public key travels inside your project key, so instances verify every pack without trusting the network.
  • Webhooks only go to public HTTPS hosts, so alert destinations can't be pointed at internal addresses.
  • Minimal data. Instances never send request bodies, headers, cookies or query strings.

Reporting a vulnerability

Email security@lightmoon.org with the affected component, steps to reproduce and the impact you expect. Please don't open a public issue or test against other customers' data. We aim to acknowledge reports within three working days and will keep you updated until the issue is fixed.

In scope: lightmoon.org, the dashboard and its API, the lightmoon npm package. Out of scope: denial of service, social engineering, and findings that need a compromised device.