Security at Strapi

Chargebee's security measures are multifaceted. Firstly, it ensures the safety of customers' payment and personal information by adhering to the PCI compliance standard. The PCI-DSS Level 1 Service Provider certification of Chargebee guarantees that sensitive card information is encrypted and managed securely. This is further reinforced by annual audits that protect sensitive data.

Additionally, Chargebee's commitment to internal data security is evident through its adherence to ISO, SOC 1 & SOC 2, and MFA standards. The SOC attestation, which includes both SOC 1 type II and SOC 2 type II reports, assures businesses of Chargebee's robust internal controls over financial reporting. Moreover, the ISO 27001:2013 certification of Chargebee signifies a comprehensive framework of policies and procedures dedicated to information risk management.

Chargebee also prioritizes network security, implementing stringent network, application, and operational level security policies. Furthermore, its dedication to global data protection standards is showcased by its GDPR commitment, ensuring the protection of personal data and aligning with global privacy goals. Chargebee's HIPAA compliance further emphasizes its capability to handle sensitive healthcare data with utmost care.

We maintain backups and revision histories based on the client's chosen plan. Once data is permanently deleted, it cannot be recovered unless required by law.

Strapi Cloud is hosted on DigitalOcean and utilizes DigitalOcean’s Identity and Access Management (IAM) capabilities. This allows us to effectively manage who has access to our production environment. Access permissions are guided by the principles of "least privilege" and "separation of duties," and are reviewed on a quarterly basis.

In Strapi's security architecture, JSON Web Tokens (JWT) with default HS256 cryptography are employed for session IDs. This choice means that there aren't typical session ID changes; however, whenever a user logs out, a new JWT token is generated. As for session duration, if a user selects the "remember me" option, the JWT token remains valid for 30 days. If not, its validity lasts only as long as the session remains open. This approach is crucial for understanding access control within Strapi.

Strapi doesn't directly store any data. Instead, data within a Strapi instance is kept in the user-connected database. Aspects like Data Loss Prevention, encryption (both at rest and during transfer), and recovery are managed by the database provider.

Strapi doesn't automatically encrypt data entered through its dashboard. However, when transferring data using Strapi’s Data Transfer System, you can add an encryption key using OpenSSL. Users need to create this key themselves during the export, as it's not done automatically. For more details, you can check out the provided information.

The Strapi Cloud database server and backups are encrypted at rest using AES-256 algorithm (encryption key stored on AWS KMS).

Only social connects are available on the platform so no password hashes are stored. Custom environment variables of hosted projects are encrypted using the AES-256 algorithm (encryption key stored on a self-hosted Hashicorp Vault server, a per project salt is used).

At Strapi, we use GitHub's pull request feature for our code reviews. When our developers add new code, they create a pull request for the team to review and give feedback. This approach lets us discuss and fix any issues before finalizing the changes. We're committed to maintaining high code quality, and this process ensures every update meets our standards.

To catch security issues, Strapi uses tools like Snyk and DependaBot from GitHub. These tools help spot vulnerabilities in our dependencies. Plus, we've got CodeFactor on our side for analyzing the quality of the code, making sure it's not just secure but also well-written.

Strapi’s got a dedicated team that uses a tool called Squash TM for manual testing and setting the groundwork for automating tests on Strapi's features. Additionally, quality assurance takes place in a separate environment, distinct from production, to ensure full isolation. And before we roll out any release, our QA team gives it a green (Go) or red (NoGo) light, ensuring everything's up to the mark and secure for our users.

To ensure robust security, Strapi doesn't rely on a dedicated third-party firm for formal penetration tests. Instead, we benefit from our vast and highly knowledgeable open-source community, where cyber-analysts frequently conduct tests. Although we don't have a contract with a preferred company for this, any vulnerabilities identified are evaluated using the CVSS and are publicly shared through CVE. Our response and remediation strategies are based on the severity and risk rating of these findings.

Strapi's CLI uses NPM or Yarn to download its source files and their dependencies, both of which have integrated integrity checks during installation. While additional manual processes can be aligned with NPM guidelines, Strapi actively updates its direct dependencies to address any known issues. The team remains cautious of breaking changes, especially from nested dependencies beyond their direct control. Instead of solely relying on NPM Audit or Yarn Audit, which offer compounded risk assessments, Strapi's Security Team prioritizes updating dependencies with significant potential impact on Strapi. Emphasizing security, the team values CVEs, which provide detailed vulnerability information, though it's noted that not all NPM/Yarn packages have specific CVE assignments.

The security of Strapi plugins is paramount; they must not contain malicious content or cause harm. Guidelines specify that plugins should not collect Strapi secrets, must handle credential storage appropriately, should be protected against common web vulnerabilities, should not expose sensitive APIs, and their dependencies should be up-to-date without known vulnerabilities​. Please see the plugin guidelines for more details