If you discover a security vulnerability in Specter, please do not open a public GitHub issue.
Instead, report it privately via GitHub's private vulnerability reporting feature on this repository, or email the maintainer directly (see the profile linked from the README).
Please include:
- A description of the vulnerability and its potential impact
- Steps to reproduce (a minimal example is ideal)
- Any suggested remediation, if you have one
We aim to acknowledge reports within 5 business days.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
This covers the Specter application code in this repository (frontend/ and backend/). It does
not cover third-party services Specter integrates with (Stripe, MongoDB Atlas, the Wire API) —
please report issues with those directly to their respective vendors.
- JWT authentication with a 30-day expiry, verified on every protected route
- Ownership checks scoping all investigation/report queries to the authenticated user
- Stripe webhook signature verification with idempotent event processing
- Rate limiting (global, per-investigation, and auth-specific)
- Helmet security headers, environment-validated secrets, bcrypt password hashing
See the README security section for the full list.