Crescentic Digital

Security Updates

Security posture of the platform and a chronological log of security updates and hardening changes.

Current posture

  • Passwords hashed with bcrypt and a per-account salt.
  • Session tokens stored as hashes; sessions are revocable.
  • Account lockout after repeated failed sign-ins.
  • Encrypted SMTP passwords at rest.
  • Strict outbound SMTP allowlist (ports 25, 465, 587, 2525; no private networks).
  • Security headers including a Content Security Policy on every response.
  • Rate limiting on sign-up and sign-in.
  • Audit logging of sensitive account actions.

Update history

Initial hardening releaseInfo2026-08-14 · v1.0.0
  • Passwords are stored using bcrypt with a random per-account salt.
  • Session tokens are stored as salted hashes; a session can be revoked from any device by signing out.
  • Repeated failed sign-ins lock the account for 15 minutes to slow credential guessing.
  • Outbound SMTP is restricted to standard ports (25, 465, 587, 2525) and private/loopback network ranges are blocked to prevent server-side request forgery.
  • Every HTTP response includes strict security headers, including a Content Security Policy.
  • SMTP account passwords are encrypted at rest; the plaintext is never logged or exposed.

Reporting a vulnerability

Found a security issue? Please report it privately to salik.ahmed@crescenticdigital.com before disclosing it publicly.

Last updated: 2026-08-14