Security

Nightingale is built with defense-in-depth security practices from day one. Security is an ongoing process, not a one-time checklist — we continue to invest in it as the platform grows.

Password security

Passwords are hashed with bcrypt (never stored in plaintext) and never logged.

Upload validation

Every file is validated by content signature (not just extension), size-capped, and stored outside any publicly executable directory.

Role-based access

Every resource request is checked against ownership and role — a student can never access another student's data.

Rate limiting

Authentication, uploads, and AI generation endpoints are rate-limited to prevent abuse.

Audit logging

Administrative actions and security-relevant events are logged and reviewable.

Session security

Sessions use secure, httpOnly cookies. Password changes and resets invalidate all existing sessions.

Found a security issue? Please report it responsibly to support@example.com rather than disclosing it publicly.