Security Policy
Last updated: June 10, 2025
Security is a core design principle at whspr, not a feature bolted on after the fact. This document describes our security architecture, policies, and how to responsibly report a vulnerability.
1. Infrastructure & Hosting
whspr is hosted on Vercel, a globally distributed edge platform with SOC 2 Type II certification. Our database is MongoDB Atlas, which encrypts all data at rest (AES-256) and in transit (TLS 1.2+). Infrastructure is isolated per deployment environment (production, preview) with separate credentials.
2. Data Encryption
In Transit
All communication between your browser and whspr is encrypted via HTTPS (TLS 1.2 / 1.3). HTTP requests are automatically redirected to HTTPS. We enforce strict HSTS headers.
At Rest
All data stored in MongoDB Atlas is encrypted at rest using AES-256. Backups are also encrypted.
Passwords
User passwords are never stored in plaintext. We use a secure one-way hashing algorithm (SHA-256 + salt) before storing credentials. Even in the event of a data breach, raw passwords cannot be recovered.
3. Authentication & Sessions
Sessions are managed via a secure, HttpOnly, SameSite=Lax cookie containing a cryptographically random session token. This mitigates cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.
OAuth (Google & GitHub): We use the standard OAuth 2.0 authorization code flow with PKCE-equivalent state parameter validation to prevent CSRF during sign-in. We never receive or store your OAuth provider password.
Sessions have a finite expiration period and are revoked on logout. Old sessions are automatically cleaned up from the database.
4. Anonymity Architecture
The core promise of whspr is anonymity for message senders. We honour this technically:
- Message sender IP addresses are never logged or stored
- No browser fingerprinting or device identification of senders
- Senders are not required to authenticate or provide any identifying information
- Messages are stored associated only with the recipient's username, not any sender identifier
- Server access logs (managed by Vercel) may contain ephemeral IP data; we do not query or export this data
5. Application Security
Injection Prevention
We use Mongoose with parameterised queries exclusively — raw MongoDB query strings from user input are never constructed, preventing NoSQL injection.
Input Validation
All user-supplied data (usernames, message text, emails) is validated and sanitised server-side before processing or storage. Client-side validation is complementary only.
Rate Limiting
API endpoints are protected at the edge level via Vercel's built-in rate limiting. Message submission and authentication endpoints have additional server-side guards.
Content Security
HTTP security headers including X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are enforced on all responses.
6. Access Control
Access to production infrastructure, database credentials, and environment variables is restricted to authorised maintainers only, protected by strong authentication and least-privilege principles. No user data is accessible to staff during normal operations.
7. Email Security
Transactional emails (notifications, welcome messages) are sent via Gmail SMTP over an encrypted TLS connection. We recommend users who receive whspr notification emails verify the sender domain matches whspr.in before acting on any link.
8. Vulnerability Disclosure (Responsible Disclosure)
Found a security issue?
We welcome responsible disclosure from security researchers. If you discover a potential vulnerability in whspr, please do not publicly disclose it before we have had an opportunity to investigate and remediate.
Please email your findings to security@whspr.in including:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept code or screenshots (if applicable)
We aim to acknowledge reports within 48 hours and to resolve confirmed vulnerabilities within 90 days. We will keep you informed of our progress.
9. Incident Response
In the event of a security incident that affects user data, we will:
- Investigate and contain the incident as a top priority
- Notify affected users by email within 72 hours of confirmation
- Provide a clear explanation of what happened, what data was affected, and what steps we are taking
- Implement preventive measures to avoid recurrence
10. Security Updates
We regularly update our dependencies to patch known vulnerabilities. Security-related changes are tracked and prioritised with the highest urgency. This policy is reviewed and updated at least annually.
11. Contact
For security concerns: security@whspr.in
For general privacy questions: privacy@whspr.in