teamegem / exchange Goto Github PK

• Content Security Policy
   is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.

• Referrer Policy
   is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.

Action items for this. @osoese @riddlez666 @jlebron3

• Implement ELLA PAIR
• Test
• Ensure security and process's are audit'ed.
• Close task

• Create user accounts for each staff member @osoese @riddlez666 @jlebron3 @MakeMoneyOz
• Harden user permissions
• Configure and harden sudo access for the above users.
• Configure user/sudo logging
• Configure SSH RSA Certifications
• Remove password logins - only permit RSA Certificates + Passphrase

• Create / Update server configuration / setup guides

Action items for this. @osoese @riddlez666 @jlebron3

• implement ELLA PAIR
• Test
• Ensure security and process's are audit'ed.
• Close task

Complete code audit

• Ensure no issues from https://sakurity.com/peatio.pdf are found within the site and ensure no similar vulnerabilities have been introduced / found since.
• Complete manual pentration test of live prod environment (web-front end & back-end infrastructure).
• Complete automated vulnerability checks.
• Ensure all packages, code-bases, and patches are installed and up-to-date.
• Update all code dependencies to latest versions.
• Link any existing OPEN CVE's without fix's to our dependencies and ensure appropriate controls are implemented to prevent exploitation.
• Create Wallet security policies and process's
• Ensure DB's are secure and hardened
• Ensure all default credentials have been changed
• Implement hardened "iptables and SELinux rules"
• Implement correct and secure security headers
• Tighten SSL policy / configurations.
• Tighten Nginx configurations / security
• Only support TSL 1.1 & 1.2 +
• Phusion security?
• User security audit, password length / complexity #8
• Create / Run bug bounty program with rewards . Hackerone etc

• Implement Google 2FA User authentication
• Implement Trezor 2FA/2FU authentication
• Test
• Audit / security test

Hi,

REDIS is used for fastly store datas temporaly, what are all the datas stored in REDIS ? How they are stored back to MYSQL ?

Thank you

• Strict-Transport-Security header.
• X-Frame-Options header.
• X-Content-Type-Options header.