Security Architecture & Overview
Code SCE is built from the ground up around the secure distribution of frontend code assets. Because digital code is easily copied once delivered, security is not an afterthought — it is the platform's architectural foundation.
Core Security Pillars
┌────────────────────────────────────────────────────────────────────────┐
│ Security Infrastructure │
├───────────────────┬────────────────────┬───────────────────────────────┤
│ Ingress & Edge │ Identity & Auth │ Asset & Delivery Security │
│ - Helmet Headers │ - OAuth Linking │ - Automated Pipeline Scanners │
│ - Rate Limiting │ - Conflict Shields │ - Single-Use Signed Downloads │
│ - CWE-532 Logs │ - Disconnect Guard │ - Dual-Layer Watermarking │
└───────────────────┴────────────────────┴───────────────────────────────┘The platform addresses security risks through independent, fail-safe layers:
| Security Layer | Threat / Risk Addressed | Implementation Reference |
|---|---|---|
| WAF & Security Middleware | XSS, MIME-sniffing, clickjacking, header spoofing | Helmet & Rate Limiting |
| CWE-532 Log Sanitization | Accidental exposure of secrets or tokens in logs | Sensitive Data Redaction |
| OAuth Linking Protection | Account hijacking, credential collision | OAuth Account Linking Rules |
| Automated Scanning Pipeline | Malicious packages, backend runtimes, NSFW content | Security Scanning |
| Secure Gated Downloads | Link sniffing, replay attacks, unauthorized downloads | Secure Downloads |
| Forensic Watermarking | Untraceable piracy and illicit distribution | Watermarking |
| Fraud & Rate Limits | Bot spam, card testing, catalog scraping | Fraud Protection |
| Cryptographic Payment IPN | Forged payments, underpaying, replay attacks | Payment Verification |
Ingress & WAF Middleware
The backend uses a tailored Helmet security suite and multi-tiered rate limiting:
- HTTP Protection: Enforces
noSniff,xssFilter, strict referrer policies, and productionHSTS(HTTP Strict Transport Security) with preloading. - Cross-Origin Isolation: Configured with
crossOriginResourcePolicy: "cross-origin"to allow secure asset rendering between the desktop shell and web client, while disabling external script tampering. - Global Rate Limiter: Implements sliding window limits (default
150 requests per 15 minutesper IP) viaexpress-rate-limitto prevent denial-of-service and endpoint flooding.
CWE-532 Log Safety & Redaction
To prevent sensitive tokens, credentials, or session cookies from ever entering server logs or APM systems (CWE-532), the platform routes all loggable payloads through a deep recursive sanitizer (redactSensitiveData and loggerSanitizer):
- Redacted Fields:
password,secret,jwtSecret,watermarkSecret,token,auth_token,auth_link_user,cookie,authorization,apiKey,privateKey,creditCard,cvv. - Any matching key is replaced with
[REDACTED]prior to logging.
OAuth Account Linking Security
Code SCE supports multiple OAuth identity providers (Google and GitHub) with strict anti-collision and anti-hijacking guarantees:
1. Anti-Hijacking Collision Prevention
Unauthenticated OAuth sign-ins never automatically merge accounts based solely on email addresses. If a user signs in with GitHub using an email already registered under Google, the server halts the operation with account_conflict.
- Resolution: The user must sign in with their original provider and connect their second provider interactively within Security Settings.
2. Interactive Linking (/auth/:provider?action=link)
Authenticated users can securely link secondary providers. A short-lived, encrypted auth_link_user cookie binds the linking transaction to their active session.
3. Provider Conflict Guard
If an incoming OAuth identity is already bound to a different Code SCE user ID, linking is rejected with PROVIDER_ALREADY_LINKED.
4. Disconnection Safeguard
Users can disconnect a connected provider (DELETE /api/auth/providers/:provider), but the system enforces CANNOT_DISCONNECT_ONLY_PROVIDER — an account cannot disconnect its sole remaining login method.
Zero Source Exposure & Forensic Watermarking
- Visual-Only Previews: Previews in Studio and Explorer rely strictly on verified visual screenshots, GIFs, and markdown documentation. Raw module code is never staged on public routes.
- Dual-Layer Watermarking: When a paid module is downloaded, Code SCE injects non-destructive zero-width HMAC signatures and metadata into the package, enabling deterministic attribution if a leak occurs.
Next Steps
- Secure Downloads → — Learn how single-use signed tokens protect file delivery.
- Watermarking → — Technical deep dive into in-code zero-width marks.
- Fraud Protection → — Behavioral rate limiting and abuse mitigation.