Security Practices

HTTPS everywhere: All connections between your browser and FileDrop are encrypted using TLS (HTTPS). HTTP requests are automatically redirected to HTTPS. Strict-Transport-Security headers (HSTS) are set to prevent downgrade attacks.

Vercel Edge Network: FileDrop is hosted on Vercel’s global edge network, which provides DDoS protection, automatic certificate renewal, and enterprise-grade TLS configuration.

HTTP-only, Secure cookies: Session tokens are stored exclusively in HTTP-only cookies, making them inaccessible to JavaScript and immune to XSS-based token theft. Cookies are flagged Secure (HTTPS-only) and use the SameSite=Lax policy to prevent cross-site request forgery.

Signed JWTs: Session tokens are cryptographically signed. A tampered or forged token is rejected immediately.

Password hashing: Passwords are stored as bcrypt hashes with a cost factor of 12. Plaintext passwords are never stored or logged.

Session expiry: Sessions expire automatically. Inactive users are warned before expiry and must re-authenticate.

Private file storage: Portfolio documents (resumes, cover letters, artifacts) are stored privately. Every file download is gated by an authenticated API route that verifies you are the owner, an assigned faculty reviewer, or an authorized administrator before serving any bytes. Raw storage URLs are never exposed to the browser.

Database: Application data is stored in Turso (libSQL), a managed SQLite service with encryption at rest and point-in-time recovery. Connection credentials are stored only in server-side environment variables — never in client code.

Email relay: Outbound email flows through the Noctusoft relay, which authenticates to SendGrid using a short-lived OIDC token. No SendGrid API key is stored in the application.

Role-based access: FileDrop enforces four distinct roles — Student, Faculty, Organization Administrator, and Super Administrator. Every API route and page verifies the caller’s role before executing. Role checks are enforced server-side; hiding a UI element does not bypass them.

Scoped portfolio access: Faculty reviewers can only see portfolios explicitly assigned to them by an administrator. Students can only see their own portfolios. Organization administrators are scoped to their own organization.

Account approval: New registrations are held in a pending state until an organization administrator approves the account. Unapproved accounts cannot access any portfolio functionality.