Security Policy

Relevant source files

The following files were used as context for generating this wiki page:

• SECURITY.md
• cooltools/middleware.ts
• cooltools/lib/phoneApi.ts
• cooltools/shared/schema.ts
• cooltools/package.json

The Security Policy of the CoolTools platform encompasses version support, vulnerability reporting procedures, and technical implementation of defensive headers and data handling. Its primary purpose is to ensure the integrity of phone comparison data and protect users interacting with the application.

This policy outlines both the administrative aspects of security, such as supported software versions, and the technical implementations found within the Next.js middleware and API integration layers.

Supported Versions

The project maintains a tiered support structure for security updates. Only specific major and minor versions receive active security patches.

Version	Supported
5.1.x	:white_check_mark:
5.0.x	:x:
4.0.x	:white_check_mark:
< 4.0	:x:

Sources: SECURITY.md:5-12

Technical Security Implementations

Middleware and HTTP Headers

The application utilizes a Next.js middleware layer to inject security-focused HTTP headers into every response. This mechanism protects the frontend against common web vulnerabilities such as Clickjacking, MIME-type sniffing, and Cross-Site Scripting (XSS).

The diagram above illustrates the flow of a request through the security middleware.

Key security headers configured:

• X-Content-Type-Options: Set to nosniff to prevent the browser from interpreting files as a different MIME type than what is specified.
• X-Frame-Options: Set to DENY to prevent the site from being embedded in frames or iframes, mitigating clickjacking attacks.
• X-XSS-Protection: Configured to 1; mode=block to enable the browser's XSS filtering and block the page if an attack is detected.
• Referrer-Policy: Set to strict-origin-when-cross-origin to limit information passed in the Referer header.

Sources: cooltools/middleware.ts:6-14

API Security and Data Resilience

The system interacts with an external mobile specifications API. To ensure availability and prevent resource exhaustion or failure during high latency, the phoneApi module implements request deduplication and retry logic.

• Request Deduplication: Uses a pendingRequests Map to track active promises. If multiple components request details for the same phone slug simultaneously, the system returns the existing promise instead of initiating multiple network calls.
• Retry Logic: The getPhoneDetails function includes a retry mechanism that attempts to fetch data up to 2 additional times with an exponential backoff (1000ms * attempt) if a request fails.

Sources: cooltools/lib/phoneApi.ts:11-12, cooltools/lib/phoneApi.ts:145-163

Data Privacy and Schemas

The application defines structured data models using Drizzle ORM to ensure data integrity. User-specific data is linked via unique identifiers.

User Data Storage

The system separates public phone specifications from user-generated content such as comparisons and reviews.

Table	Security/Privacy Concern	Implementation
comparisons	User Privacy	Stores userId alongside phone_ids to restrict access to saved comparisons.
reviews	User Attribution	Associates userId with ratings and content.
phones	Data Integrity	Uses unique slug and strict typing for hardware specs.

Sources: cooltools/shared/schema.ts:77-83, cooltools/shared/schema.ts:93-102

Vulnerability Reporting

The project encourages responsible disclosure of security vulnerabilities. Users and researchers are instructed to follow a specific reporting process, though the specific contact points are defined in the project's documentation rather than hardcoded in the logic.

The reporting policy covers:

• Where to report the vulnerability.
• The expected timeline for updates on reported issues.
• The criteria for acceptance or decline of a reported vulnerability.

Sources: SECURITY.md:14-20

Dependencies and Maintenance

The project relies on several core libraries that are regularly audited for security through the npm lint and build processes.

• Next.js (15.5.4): Provides the framework security foundations.
• Prisma/Drizzle: Used for secure database interactions to prevent SQL injection.
• Axios: Configured with timeouts (e.g., 5000ms) to prevent hanging connections.

Sources: cooltools/package.json:20-30, cooltools/lib/phoneApi.ts:152

The security of the CoolTools platform is maintained through a combination of strict versioning policies, automated middleware headers to protect the client side, and resilient API handling to ensure service availability.