๐๏ธ API Security Best Practices
Comprehensive API security patterns and practices used in Ever Gauzy.
๐๏ธ Security Overview
Security architecture and best practices for Ever Gauzy deployments.
๐๏ธ Data Protection
Data handling practices, GDPR compliance, and privacy controls.
๐๏ธ Tenant Isolation
How Ever Gauzy ensures complete data isolation between tenants.
๐๏ธ Input Validation & Sanitization
How Gauzy validates and sanitizes all incoming data.
๐๏ธ Rate Limiting
API rate limiting and throttling configuration powered by @nestjs/throttler.
๐๏ธ File Upload Security
Security controls for file uploads in Ever Gauzy.
๐๏ธ CORS Configuration
Cross-Origin Resource Sharing settings for the API.
๐๏ธ Secret Management
Best practices for managing secrets and sensitive configuration.
๐๏ธ Authentication Flows
Detailed documentation of all authentication flows, including login, passwordless sign-in, workspace switching, and social account linking.
๐๏ธ Tenant API Keys
Programmatic API access using tenant-scoped API keys.
๐๏ธ Audit Logging
Track user actions and system events for compliance and security auditing.
๐๏ธ Token Lifecycle
Detailed documentation on JWT token structure, validation strategies, token rotation, and revocation.
๐๏ธ Password Security
Password hashing algorithms, policy enforcement, and secure password reset flows.
๐๏ธ OAuth App Authorization (Server-to-Server)
For third-party integrations, an OAuth 2.0-style authorization code flow is supported for server-to-server communication.
๐๏ธ Public Endpoint Data Exposure
How to prevent information leaks through TypeORM relation loading in public API endpoints.
๐๏ธ Content Security Policy (CSP)
Configure Content Security Policy headers for XSS protection.
๐๏ธ API Rate Limiting Deep Dive
Protect your API from abuse with rate limiting.
๐๏ธ XSS and CSRF Prevention
Protect against Cross-Site Scripting and Cross-Site Request Forgery.
๐๏ธ Security Headers Reference
Complete list of recommended security headers for production deployments.
๐๏ธ JWT Token Management
Deep dive into JWT-based authentication.
๐๏ธ Vulnerability Scanning
Automated security scanning for the Gauzy codebase.
๐๏ธ OAuth2 & Social Auth Flows
Configure social login and OAuth2 authentication.
๐๏ธ Data Encryption
Encryption at rest and in transit for Gauzy deployments.
๐๏ธ GDPR & Compliance
Data protection and regulatory compliance in Ever Gauzy.