Security

1. Data at Rest — AES-256-GCM

Cloudflare credentials (Account ID and API token or OAuth tokens) are encrypted with AES-256-GCM before they are written to MongoDB Atlas. Each value is stored alongside its own IV and GCM authentication tag (cloudflareAccountIdIv/Tag and cloudflareTokenIv/Tag). The ENCRYPTION_KEY is a 32-byte (64-hex-char) key held in the server environment — never in the database — and the service fails fast if the key is missing or of the wrong length.

TOTP secrets for two-factor authentication are encrypted the same way, per device. Worker scripts and configuration metadata stored for deployment history contain only origin URLs, weights, and strategy choices — no secrets.

2. Data in Transit — TLS & Hardened Cookies

All communication between browser, EdgeBalancer, and upstream providers is encrypted with TLS. Authentication uses JWTs in httpOnly cookies with SameSite=Strict. The session cookie is 24-hour expiry; the 2FA challenge cookie (eb_2fa) is 5-minute expiry and carries stage: 'pending-2fa' so it can never be renamed into a session — the auth middleware rejects any token that carries a stage.

CORS is restricted to the configured CORS_ORIGIN / CLIENT_URL. Error responses never leak credentials, stack traces, or internal IDs.

3. Passwords — bcrypt

Where a password is set, it is hashed with bcrypt (10 rounds) before storage. Plaintext passwords are never written to the database or to logs. Google-only accounts have a null password and authenticate via Firebase ID tokens.

4. Cloudflare Token Permissions

EdgeBalancer requests the minimum Cloudflare token scopes required to operate. Each maps to an endpoint the service actually calls:

Not needed: Workers KV Storage. Nothing binds or reads KV. An optional Zone · Workers Routes · Read scope improves hostname-conflict detection when present, but deploys work without it.

5. No Traffic Proxy

EdgeBalancer never proxies your production traffic. All requests flow directly from the Cloudflare edge to your origin servers via the Worker script deployed in your Cloudflare account. We store only metadata — origin URLs, weights, strategy choice — encrypted at rest. If EdgeBalancer is temporarily unavailable, your load balancers and gateways continue to serve traffic.

You retain full ownership: delete the API token or the Worker scripts from the Cloudflare dashboard and the deployment is gone — there is no lock-in.

6. Responsible Disclosure

If you discover a security vulnerability, please report it responsibly. Do not publicly disclose the issue until we have had a chance to address it.

Contact: security@nexoral.in

Please include a description of the vulnerability, steps to reproduce, and the potential impact. We will acknowledge receipt within 2 business days and keep you updated on the fix.