Login Sign Up

Security

Our comprehensive approach to protecting your software and data

Last Updated: March 30, 2025

Our Security Commitment

At Shieldz, security is not just a feature—it's the foundation of everything we build. Our licensing system is designed with multiple layers of protection to ensure your software, your customers' data, and your business interests are secure. We employ industry-leading security practices and continually update our systems to address emerging threats.

Defense in Depth

Protection:

Multiple security layers with independent protection mechanisms to ensure that if one fails, others remain intact.

Encryption

Protection:

Military-grade AES-256 encryption for sensitive data with secure key management practices.

Authentication

Protection:

Robust authentication with JWT and session-based mechanisms, with strict password policies.

Rate Limiting and Brute Force Protection

We implement strategic rate limiting to protect sensitive endpoints from abuse and brute force attacks:

Authentication Protection

  • After exceeding the limit, accounts are temporarily blocked for 30 minutes
  • Applies to both customer and admin login

Registration Protection

  • Prevents automated account creation

License Verification

  • Blocks excessive verification requests for 15 minutes
  • Protects against brute force attacks against license keys

Export Operations

  • Includes clear retry information with time-based lockouts

All rate limiters include:

  • IP-based tracking for unauthenticated requests
  • User ID-based tracking for authenticated requests
  • Exponential backoff for repeated violations
  • Informative error messages with retry timeframes
  • Secure logging of rate limit events

Enhanced Integrity Protection

Our system employs an advanced multi-layered integrity protection system to prevent tampering with your software:

Core Protection Features

  • Native Code Integration: Critical security checks run in compiled C/C++ code rather than JavaScript
  • OS-Level Integrity Checks: Platform-specific security features detect debugging and tampering attempts
  • Code Signing Verification: Executable signatures are verified for authenticity
  • Secure Hash Storage: File hashes are stored in encrypted form outside the application directory
  • Runtime Environment Analysis: Detection of analysis tools, debuggers, and virtualization
  • Path Validation: All file paths are validated against whitelists and sandboxed to prevent unauthorized access
  • Platform-Specific Security: Specialized security checks for Windows, macOS, and Linux

Recent Security Improvements

  • Fixed arbitrary file read vulnerability in tamper detection utilities
  • Enhanced client-side integrity checks with secure hash storage
  • Added OS-level integrity verifications including code signing checks
  • Implemented encrypted storage for file hashes with hardware-derived keys
  • Fixed IDOR vulnerabilities with proper authorization checks
  • Implemented security headers using helmet.js
  • Secured file operations with comprehensive validation

Security Update Fallback System

We implement a robust security update mechanism with offline fallback capabilities to ensure protection even when internet connectivity is limited:

Security Update Features

  • Offline Validation: Updates and their cryptographic signatures are stored locally for verification when online servers are unreachable
  • Grace Period Management: Configurable grace period (7 days by default) during which the application can run offline
  • Update Enforcement: Mandatory security updates are enforced even when offline to maintain system integrity
  • Signature Verification: All updates are cryptographically verified using both online and offline mechanisms
  • Tamper-Resistant Storage: Security update history is stored in encrypted form to prevent manipulation

Implementation Details

  • Update Storage: Security updates are securely stored with their signatures for offline verification
  • Consecutive Failure Tracking: The system tracks consecutive connection failures to determine when to enforce offline policies
  • Transparent Notifications: Clear user notifications about update status and grace period limitations
  • Self-Protecting Design: The update system protects its own integrity through encryption and signature verification
  • Graceful Degradation: Provides appropriate fallback behavior based on update severity and connectivity status

API Data Validation and Sanitization

We implement comprehensive input validation and sanitization to prevent data injection attacks:

Validation Features

  • Type Checking: All input fields are validated for correct data types
  • Range Validation: Numeric values are checked against acceptable ranges
  • Format Validation: String values are validated for proper format and length
  • Required Fields: Mandatory fields are enforced for all operations
  • Schema Validation: Input is validated against defined schemas before processing

Sanitization Process

  • XSS Prevention: All string inputs are sanitized to prevent cross-site scripting attacks
  • Script Removal: Script tags and JavaScript event handlers are automatically removed
  • HTML Entity Encoding: Special characters are encoded to prevent injection attacks
  • Recursive Sanitization: Nested objects and arrays are recursively processed
  • Type Coercion Prevention: Type validation ensures values are not incorrectly coerced

File Operation Security

We implement comprehensive file operation security to prevent path traversal attacks and unauthorized file access:

Implemented Protections

  • Path Validation: All file paths are validated against a whitelist of allowed directories
  • Path Normalization: Paths are normalized to resolve directory traversal attempts
  • Directory Sandboxing: File operations are restricted to specific allowed directories
  • Absolute Path Resolution: Relative paths are converted to absolute paths before validation
  • Error Handling: Failed validation attempts are logged and gracefully handled

Security Headers

We implement a comprehensive set of HTTP security headers to protect against various client-side attacks:

Implemented Headers

  • Content-Security-Policy (CSP): Restricts which resources can be loaded and executed
  • X-Frame-Options: Prevents clickjacking attacks by disallowing framing of the application
  • Strict-Transport-Security (HSTS): Enforces secure (HTTPS) connections to the server
  • X-Content-Type-Options: Prevents MIME type sniffing security vulnerabilities
  • X-XSS-Protection: Provides protection against cross-site scripting (XSS) attacks
  • Referrer-Policy: Controls how much referrer information should be included with requests
  • Permissions-Policy: Restricts which browser features can be used in the application

Encrypted Communications

Our system features robust end-to-end encryption for client-server communications:

Encryption Features

  • Payload Encryption: AES-256-GCM symmetric encryption for all API payloads
  • Key Exchange: RSA-4096 asymmetric encryption for secure key exchange
  • Automatic Key Rotation: Session keys rotate every 24 hours
  • Message Authentication: GCM authentication tags ensure data integrity
  • Transparent Integration: Encryption middleware handles encryption/decryption automatically

Security Benefits

  • Protection against man-in-the-middle (MITM) attacks even when using HTTP
  • Defense against payload sniffing and manipulation
  • Secure transmission of sensitive client data (license keys, hardware IDs)
  • Protection of proprietary server responses and business logic

Password Security

We implement robust password security measures to protect user accounts:

Password Security Features

  • Strong Password Requirements: Enforces minimum length, complexity, and entropy
  • zxcvbn Integration: Uses Dropbox's zxcvbn library for advanced password strength estimation
  • Common Password Prevention: Blocks known weak and compromised passwords
  • Contextual Validation: Prevents using personal information in passwords
  • Password History: Prevents reuse of recent passwords (up to 5 previous passwords)
  • Account Lockout: Temporarily locks accounts after multiple failed login attempts
  • Secure Password Reset: Time-limited, secure token-based password reset process

Account Protection

We implement a robust account lockout mechanism to prevent brute force attacks:

Account Protection Features

  • Progressive Lockout: Exponential backoff increases lockout duration with repeated failures
  • Suspicious Activity Tracking: Records and alerts on unusual authentication patterns
  • Detailed Audit Logs: Tracks all failed login attempts with IP address and user agent
  • Automatic Notifications: System can notify administrators of suspicious activity
  • Admin Security: Enhanced security for administrative accounts
  • IP-Based Tracking: Monitors patterns across multiple accounts

Lockout Levels

Our system implements a multi-tiered lockout strategy:

  • 3-4 failed attempts: 5-minute lockout
  • 5-6 failed attempts: 30-minute lockout
  • 7-9 failed attempts: 2-hour lockout
  • 10+ failed attempts: 24-hour lockout

Build-Time Dependency Security

We implement comprehensive security measures to prevent dependency substitution attacks during the build process:

Package Integrity Protection

  • Lockfile Security: Strict lockfile version control using package-lock.json
  • SHA-512 Integrity: Integrity hashes for all dependencies
  • Automated Lockfile Maintenance: Regular verification of dependency integrity

Build Process Security

  • Pre-build Checks: Integrity checks before building
  • Build Validation: Verification of build artifacts
  • Post-build Verification: Final bundle integrity checks

Security Reporting

We take security issues seriously and appreciate the help of security researchers and our user community. If you discover a security vulnerability in Shieldz, please report it responsibly:

How to Report Security Issues

Our Commitment

  • We will acknowledge receipt of your report within 24 hours
  • We will provide an initial assessment within 72 hours
  • We strive to fix verified security issues as quickly as possible
  • We will keep you informed of our progress
  • We offer a responsible disclosure program with recognition for researchers

Regular Security Audits

To ensure the highest level of security, we conduct regular security audits and assessments:

  • Automated security scans on every code push
  • Regular penetration testing by third-party security experts
  • Vulnerability assessments of our infrastructure
  • Code reviews focused on security
  • Dependency vulnerability scanning