Security Architecture & Threat Model
This document details FlipLane’s credential management, encryption standards, rotation protocols, DNS authentication, and honest threat model analysis.
Encryption Standard
AES-256-GCM
256-bit symmetric vault keys
Session Isolation
Single-Use Nonces
60s TTL • Ephemeral proxy tokens
Email Authentication
SPF / DKIM / DMARC
Aligned domain deliverability
1. Encryption Architecture & Storage Standards
All sensitive operational secrets are isolated in protected server-level keyrings. Secrets and private credentials are never committed to version control, client-facing bundles, or public interfaces.
| Security Domain | Implementation | Protection Standard |
|---|---|---|
| Auction Vault Encryption | AES-256-GCM authenticated symmetric encryption | Isolated server vault keying |
| Administrative Gatekeeper | Role-based access enforcement and cryptographic session signing | Continuous session validation |
| Wholesale Terminal Proxy | Single-use ephemeral proxy nonces with 60s TTL | Zero plaintext password client disclosure |
| Transactional Messaging | Authenticated TLS mail transport with SPF, DKIM, DMARC alignment | Strict domain spoofing prevention |
2. Threat Model Analysis
What is Protected
- Strict administrative gating (403 for unauthorized users)
- Auction passwords stripped before reaching client browsers
- Cryptographic CSRF token validation on all POST routes
- Sliding-window IP rate limiting on login/signup/reset
- Standard security headers (X-Frame-Options, CSP, nosniff)
- Tamper-evident append-only audit logging
Known Limitations & Gaps
- Non-TLS local traffic lacks cookie Secure flag
- CSP allows 'unsafe-inline' scripts for CDN & inline Twig widgets
- CloudFront / Imperva WAF blocks headless requests from non-US IPs
- Database protection relies on strict filesystem permissions and encryption at rest
Corporate security standards and compliance protocols are administered under Byrd Dawgs Automotive Group LLC.
Print Manual →