Security Architecture

Built secure. Not bolted on after.

Every security measure is in place before your first API call. You inherit enterprise-grade protection without writing security code.

bcrypt · 12 rounds
Rate limiting · 3 layers
HMAC signing

Security Layers

Defense in depth. Multiple overlapping protections ensure that if one layer fails, others remain intact.

bcrypt Hashing

Never store secrets in plaintext

  • Passwords hashed with bcrypt at 12 rounds (industry standard)
  • Verification codes hashed with bcrypt at 10 rounds
  • TOTP secrets encrypted at rest with AES-256
  • All hashes use unique salts (bcrypt automatic)
  • Rainbow tables and precomputed attacks are ineffective

Rate Limiting

Distributed protection across all layers

  • Per-email: 3 reset requests per hour
  • Per-IP: 10 reset requests per hour
  • Per-connection: 100 requests per hour
  • Sliding window algorithm (no reset edge cases)
  • Held in a shared store, so limits agree across instances
  • Applied at the edge of the API, before any work is done

Enumeration Protection

Prevent user database probing

  • Identical responses for existing/non-existing emails
  • Timing-safe comparisons (constant-time execution)
  • Dummy bcrypt operations when user doesn't exist
  • Response times identical within 5ms variance
  • Attackers can't determine if email is registered

Brute Force Protection

Account lockout prevents guessing attacks

  • 5 failed verification attempts = permanent session lock
  • 6-digit codes = 1 million combinations
  • 5 attempts = 0.0005% chance of guessing correctly
  • Locked sessions cannot be reused (one-time tokens)
  • No way to brute force codes before lockout triggers

CSRF Protection

Prevent cross-site request forgery

  • CSRF tokens required on all mutations
  • Tokens rotate on every request
  • SameSite=None; Secure cookies (cross-domain safe)
  • Origin header validation
  • Double-submit cookie pattern

Webhook Signing

Verify requests are genuinely from ResetKit

  • HMAC-SHA256 signatures on all webhook requests
  • Signature in X-ResetKit-Signature header
  • Timestamp included (prevents replay attacks)
  • Secret key unique per connection
  • Verify signature before processing webhooks

Infrastructure Security

Every layer runs on managed infrastructure with encryption on by default. We do not name providers here, on purpose.

DatabaseManaged, encrypted

Encrypted at rest and in transit, network access restricted to the API, credentials rotated on a schedule

Rate limiting storeShared, ephemeral

Encrypted in transit, authentication required, counters expire on their own

Email deliveryAuthenticated sending

Domain signing and sender policy records, bounce handling, a second path if the first fails

API hostingManaged platform

Automatic HTTPS, DDoS protection, isolated runtime per deploy

MonitoringIn-house logging

Audit trails for all auth events, PII scrubbing, 90-day retention

Token & Session Management

Short-lived tokens and one-time use patterns minimize attack windows.

Password Reset Sessions

  • • 15-minute expiration from session creation
  • • Locked permanently after 5 failed verification attempts
  • • One-time use (cannot be reused after successful reset)
  • • Session ID is 64-character hex (256 bits of entropy)

2FA Codes

  • • 5-minute expiration (shorter window than reset)
  • • 6 digits = 1 million combinations
  • • Locked after 5 failed attempts = 0.0005% success rate
  • • Codes bcrypt-hashed (10 rounds) before storage

Magic Links

  • • 30-minute expiration for email verification
  • • 32-character hex tokens (128 bits of entropy)
  • • One-time use with consumption tracking
  • • Expired tokens are deleted automatically by the database

Compliance & Standards

We adhere to industry standards and actively pursue certifications.

GDPR

Compliant

Right to access, rectification, erasure, portability. Data processing agreements available.

CCPA

Compliant

California consumer privacy rights supported. Do-not-sell honored.

SOC 2 Type II

Planned

Not yet certified and no audit currently underway. Timeline to be determined. If SOC 2 is a requirement for you, get in touch and we will talk about it directly.

OWASP Top 10

Addressed

All OWASP Top 10 vulnerabilities mitigated in design and implementation.

Responsible Disclosure

We take security seriously. If you discover a vulnerability, please report it responsibly:

  • Email support@resetkit.dev with "security" in the subject line
  • Allow us 90 days to investigate and patch before public disclosure
  • Do not exploit the vulnerability beyond proof-of-concept testing
  • We'll acknowledge your report within 48 hours and provide updates
Report a vulnerability

Last security audit: September 12, 2026