Security, Rate Limiting & Scanning

Relevant source files

The following files were used as context for generating this wiki page:

• SECURITY.md
• README.md
• apps/web/src/app/(marketing)/security/responsible-disclosure/page.tsx/security/responsible-disclosure/page.tsx)
• apps/web/src/lib/ai/prompts.ts
• AGENTS.md
• apps/web/src/app/(marketing)/dpa/page.tsx/dpa/page.tsx)

KudosWall implements a multi-layered security architecture designed to protect user data, ensure platform integrity, and maintain a safe environment for collecting testimonials. The system combines modern authentication protocols, automated content scanning via AI, and strict rate limiting to prevent abuse.

The security scope covers the main marketing site, the dashboard platform, and both public and internal APIs. By leveraging edge-optimized proxies and serverless infrastructure, KudosWall ensures that security measures do not compromise the low-latency requirements of the Testimonial Management System.

Sources: apps/web/src/app/(marketing)/security/responsible-disclosure/page.tsx:88-100, README.md:17-25, SECURITY.md:27-35

Security Architecture & Data Protection

KudosWall is built on a type-safe stack that mitigates common web vulnerabilities through architectural choices rather than just bolt-on features.

Core Security Components

The platform utilizes several industry-standard tools and patterns to ensure data integrity:

• Authentication: Managed via Better-Auth, supporting secure sessions, Multi-Factor Authentication (MFA), and OAuth (Google, GitHub, LinkedIn).
• Type Safety: End-to-end type safety using tRPC and Zod prevents data-mismatch vulnerabilities and ensures all API inputs are strictly validated at runtime.
• SQL Injection Prevention: The use of Drizzle ORM ensures all database queries are parameterized by default.
• XSS & CSRF Protection: Built-in Next.js 16 protections are augmented with strict Content Security Policies (CSP).
• Media Security: Video testimonials are delivered via secure Cloudflare R2 paths using HMAC-SHA256 signed URLs with a 3600s TTL.

Sources: SECURITY.md:27-35, README.md:58-69, AGENTS.md:17-25, AGENTS.md:83-85

Request Data Flow

The following diagram illustrates how security layers are applied from the Edge Proxy down to the data layer:

Content Scanning & Abuse Prevention

KudosWall employs an "Intelligence Engine" to automatically scan and filter incoming testimonials. This system utilizes AI-driven prompts to detect spam, toxicity, and sentiment mismatches.

AI-Driven Spam Detection

The system uses specialized prompt engineering to filter out marketing bots and toxic content. It specifically targets external links and profanity.

Feature	Logic / Capability
Spam Filtering	Detects crypto spam, bot patterns, and external marketing links.
Toxicity Detection	Identifies profanity and abusive language.
Sentiment Analysis	Detects "mismatches" between star ratings and written feedback (e.g., 5 stars but negative text).
Conflict Resolution	Flags ambiguous content for human review instead of automatic processing.

Sources: apps/web/src/lib/ai/prompts.ts:15-35, apps/web/src/lib/ai/prompts.ts:161-178

Sentiment Analysis Flow

Rate Limiting & Access Control

Rate limiting is enforced to protect internal and public APIs from denial-of-service (DoS) attacks and brute-force attempts.

Infrastructure Providers

Infrastructure for rate limiting and data processing is distributed across global providers to ensure reliability:

• Upstash: Provides Redis-backed rate limiting for global operations.
• Vercel: Handles Edge Functions and serverless execution.
• Cloudflare R2: Manages secure video storage and delivery.

Sources: apps/web/src/app/(marketing)/dpa/page.tsx:96-108, README.md:38-56

Permission Logic

Access to resources is governed by a strict hierarchical permission system:

1. Workspaces: Users belong to workspaces, and data is partitioned by workspaceId.
2. Roles: Standard and protected procedures differentiate between public visitors and authenticated workspace members.
3. Plan-Gated Limits: Security also involves enforcing resource limits (e.g., number of testimonials or projects) based on the user's Stripe billing state.

Sources: AGENTS.md:38-41, README.md:20-22, README.md:68-69

Vulnerability Disclosure & Compliance

KudosWall maintains a proactive stance on security through a structured disclosure program and strict data processing agreements.

Responsible Disclosure Program

Security researchers are encouraged to report vulnerabilities via security@kudoswall.org. The program follows a 90-day coordinated disclosure policy.

In-Scope Domains:

• kudoswall.org (Marketing)
• app.kudoswall.org (Platform)
• api.kudoswall.org (APIs)
• Testimonial widgets and embed scripts.

Sources: apps/web/src/app/(marketing)/security/responsible-disclosure/page.tsx:88-100, SECURITY.md:12-25

Data Processing & Privacy

The platform is designed with "Privacy by Design," utilizing cookie-less tracking via anonymized IP/User-Agent hashing for widget visitors.

Security Standard	Compliance Status
GDPR	Compliant (Data Processing Agreement available)
CCPA	Compliant
TLS Encryption	All data in transit
AES-256	All data at rest

Sources: apps/web/src/app/(marketing)/dpa/page.tsx:55-75, apps/web/src/app/(marketing)/dpa/page.tsx:112-125

Conclusion

Security at KudosWall is an integrated concern ranging from type-safe code standards and ORM-enforced parameterization to AI-based content scanning. By combining technical guardrails like Zod validation and HMAC media signing with operational policies like the Responsible Disclosure program, the platform provides a resilient environment for social proof management.