Security

A summary of the security controls QAForgeHub actually implements today. For the full technical detail, see the project's docs/SECURITY.md.

Account security

Passwords are hashed with Argon2id and never stored or logged in plain text. Optional TOTP two-factor authentication is available to every user, with one-time recovery codes; organizations can require it for owner/administrator roles. Sessions are randomly generated, stored server-side as a hash, rotated on login and on password reset/change, and can be reviewed and revoked individually from Account settings.

Data isolation

Every organization's data is isolated from every other organization's at the database-query level, not just in the interface. Planning Poker votes stay hidden from everyone, including the facilitator, until a round is revealed.

Transport and browser protections

HTTPS in production, a Content-Security-Policy restricting script execution to the application's own code, clickjacking protection, and standard hardening headers.

Abuse protection

Login, registration, password reset, and other sensitive actions are rate-limited. Registration currently requires a valid invitation.

Reporting a vulnerability

Email support@qaforgehub.com with "Security Report" in the subject line, and enough detail to reproduce the issue: affected route/feature, steps, and impact. Don't include real user data, credentials, or session tokens in your report, and please don't disclose vulnerabilities publicly before they've been addressed. See the repository's SECURITY.md for the full policy, including scope and what to expect.

What's not yet true

QAForgeHub does not claim formal compliance with any specific legal or security certification framework (e.g. SOC 2, ISO 27001, HIPAA, PCI DSS). It is an actively developed platform undergoing continued security hardening, and has not been independently audited or certified.