Built to beattacked.

What every request passes

Seven checks, in this order

1. 1HTTPS only — HSTS for two years, including subdomains.
2. 2A per-request nonce policy decides which scripts may run.
3. 3A 15-minute token, from a session you can see and end.
4. 4Changes must come from kodeo.website itself (Origin + Fetch-Metadata).
5. 5Your session, re-checked — suspended accounts and ended sessions stop here.
6. 6The body must match a strict schema, or it’s refused.
7. 7Values reach Postgres as parameters, never as SQL.

Script injection

Stopped at the outer wall

Getting your browser to run someone else’s JavaScript on kodeo.website — to read the page or act as you.

• Every page carries a Content-Security-Policy with a fresh random nonce per request: a script without it never runs, and `unsafe-eval` is not allowed anywhere.
• Anything people write — names, comments, chat, Markdown, AI answers — is rendered as text or through our own parser, never as raw HTML.
• Project files are only ever sent as downloads (`Content-Disposition: attachment`, `nosniff`, a sandbox CSP), so an uploaded .html or .svg can’t execute here.

Forged requests

Stopped at the first post in the courtyard

Another site making your browser send a request to KODEO — while you’re signed in — that you never meant to send.

• Every request that changes something must come from our own origin: the `Origin` header is checked, and so is the browser’s `Sec-Fetch-Site`.
• Bodies are JSON, which another site can’t send across origins without a preflight we never approve.
• Sign-in cookies are `SameSite`, and the Console’s are `SameSite=Strict` with a custom header on every action.

Stolen session

Stopped at the second post

Taking a copy of your signed-in cookie and using it from somewhere else.

• Session cookies are `httpOnly` and `__Host-` scoped: the page’s own scripts can’t read them (the check further down this page shows it).
• The access token lives 15 minutes. The refresh token rotates on every use — replaying an old one is detected, and the whole session family is ended at once.
• Every device is listed in Settings → Sessions with its full address; one tap ends it, and “This wasn’t me” ends all of them.

Password guessing

Stopped at the gatehouse

Trying leaked or common passwords against accounts, fast and at scale.

• Passwords are stored only as Argon2id hashes (19 MiB memory, 2 passes) — slow and memory-hard by design.
• Attempts are rate-limited per address and per account, with a temporary lock after repeated failures; staff can block an address outright.
• Two-factor (an authenticator app or a passkey) means a right password alone still doesn’t open the account — and a new device is emailed to you.

Phishing page

Stopped at the gatehouse

A convincing copy of the sign-in page that collects what you type.

• Passkeys are bound to kodeo.website by your device: a look-alike domain simply can’t ask for them.
• Sensitive actions ask you to confirm it’s you again (“step-up”) — with two-factor on, an emailed code alone is never enough.
• A sign-in from a new device sends you an alert with a one-tap “This wasn’t me”.

SQL injection

Stopped at the vault door

Smuggling database commands inside ordinary input — a search box, a name, a file path.

• Every query is parameterised: values travel separately from the SQL text, so input can never become a command. Nothing is string-built.
• Input is checked against a schema before it reaches a query, and file paths go through one validator that refuses traversal, control characters and reserved names.
• Each change runs in a transaction with the right locks, so a half-applied write never exists.

Malicious project

Stopped at the moat

Code inside a project — yours, a teammate’s, or a cloned repository — trying to reach your KODEO account.

• Code runs in your own browser tab (WebContainers), in a frame on a different origin — it can’t read KODEO’s cookies, pages or storage.
• Only the editor is cross-origin isolated, and a running app is shown in a sandboxed frame; nothing a project prints is ever served from kodeo.website.
• Files written by a run come back only through checks on the server: your role, the path validator, the plan’s limits, binary detection.

Token theft

Stopped at sealed inside the vault

Getting hold of your GitHub access, or the secret behind your two-factor codes.

• GitHub tokens are encrypted with AES-256-GCM under their own key, bound to your account, and used only on the server — no route ever returns one.
• Two-factor secrets are sealed the same way; backup codes, reset links and recovery codes are stored only as hashes.
• Commits are scanned for secrets before they’re made, and exports never include tokens or other people’s email addresses.

Realtime server breach

Stopped at the broken bridge

Taking over the live-collaboration server and using it to reach the database.

• The collaboration server holds no database credentials at all: every read and write goes through one HMAC-signed endpoint with a replay window.
• Membership is re-checked on each call, and permissions are checked per message — a viewer’s edits are dropped on the server.
• Removing someone from a workspace ends their live connection at once.

Rogue insider

Stopped at the watchtower

Someone with staff access abusing it — or someone who took over a staff account.

• Staff need two locks — a staff record and an address on a list held outside the database — and a separate Console session that ends after 15 idle minutes.
• Dangerous actions need a passkey from the last five minutes, and a key added in the last 24 hours can’t confirm them.
• Everything staff do is written to an append-only, hash-chained audit log that the database itself refuses to edit. Personal details are masked by default.

Payment tampering

Stopped at the treasury

Faking a successful payment — or changing the amount — to unlock a paid plan.

• A plan changes only when Cashfree’s signed webhook (or our own call to Cashfree) says so — never on a redirect or anything the browser sends.
• Prices come from the server; amount or currency mismatches are never credited, and every transition is idempotent inside a transaction.
• Card details are entered on Cashfree’s page. KODEO never sees them.