Security at Plenumos

Access and sessions

• Organizer accounts and conference roles are separated from speaker access.
• Conferences can be public, password-protected, mixed, or private with dedicated speaker links.
• Administrator account passwords are hashed with bcrypt.
• State-changing requests, including logout, require a session-bound CSRF token.
• Login and password-reset endpoints are rate-limited with a proxy-aware client key.
• Access-link tokens are removed from the address bar immediately after authentication and sensitive pages are marked no-store.
• Session and remember-me cookies are HttpOnly, SameSite=Lax, and Secure in production.

Magic links grant access and should be handled like credentials. Organizers can regenerate access when a link is shared with the wrong person.

Uploads and files

• Organizers choose an allowlist of supported presentation and image formats and set file-size and version limits.
• Uploads are checked against file signatures and expected document structure, not just filename extensions.
• Suspicious double extensions are rejected and stored filenames are normalized.
• Resolved file paths are checked to prevent files from escaping the configured upload directory.
• Uploaded files are kept outside the application code with restrictive operating-system permissions.

File validation reduces risk but is not a substitute for endpoint protection. Organizers should avoid distributing unexpected files and should scan exported materials under their institution’s normal policy.

Application and infrastructure

• HTTPS is enforced and production responses use HSTS, a Content Security Policy, clickjacking protection, origin isolation, and browser capability restrictions.
• The production application runs as a non-root user in a read-only container with Linux capabilities dropped and no-new-privileges enabled.
• Database and mail secrets are supplied from restricted runtime secret files rather than committed source files.
• Protected and administration pages are excluded from indexing and receive private no-store cache controls.

Backups and recovery

Eligible real conferences receive change-aware snapshots. Changed snapshots are kept densely for 72 hours and then daily, normally for up to 14 days. Artificial sample conferences are excluded.

Full-system backups and conference snapshots currently live on the application server. They protect against application mistakes and bad deployments, but not complete server or disk loss. An off-site disaster-recovery copy remains on the security roadmap and will be disclosed honestly during pilot review.

Report a security issue

Please email [email protected] with “Security issue” in the subject. Include the affected URL, what you observed, and a safe way to reproduce it. Do not access other users’ data or publish sensitive details while we investigate.