Skip to main content
Was this helpful?

Security Whitepaper

This document describes the technical security measures implemented in PrimeCal v1.3.4. It is intended for administrators, compliance officers, and security reviewers evaluating PrimeCal for organizational deployment.

Authentication​

PrimeCal uses JSON Web Tokens (JWT) for API authentication:

  • Tokens are signed with a secret key configured via the JWT_SECRET environment variable
  • Tokens are transmitted via HTTP headers (not cookies) on API requests
  • All API endpoints (except the public feature-flags and public booking endpoints) require a valid JWT
  • Tokens expire on a configured schedule — users are required to re-authenticate on expiry

Password Storage​

User passwords are hashed using industry-standard cryptographic hashing (bcrypt or equivalent). Plaintext passwords are never stored in the database.

Input Validation and SQL Injection Prevention​

  • All API inputs are validated against DTO schemas using NestJS validation pipes before reaching business logic
  • Database queries use TypeORM's query builder with parameterized queries — user input is never directly interpolated into SQL strings
  • Output is sanitized before being returned to clients to prevent XSS through stored content

Transport Security​

  • The web application frontend communicates with the backend API over HTTPS in production deployments
  • CORS is configured via the FRONTEND_URL environment variable, restricting API access to the configured origin
  • Self-hosted administrators are responsible for configuring TLS termination on their infrastructure

Database Security​

  • Database access requires authentication via configured credentials (set in the .env file, never committed to source control)
  • The database connection uses standard PostgreSQL authentication
  • The DB_SSL environment variable controls SSL for the database connection — this should be set to true in production deployments where the database host supports it

API Rate Limiting​

PrimeCal includes request rate limiting (via NestJS Throttler module) to protect against brute-force attacks on authentication endpoints.

Secrets Management​

  • All secrets (JWT secret, database credentials, OAuth client secrets) are stored in environment variables, never in source code
  • .env files are excluded from version control via .gitignore
  • OAuth tokens for external calendar sync are stored encrypted in the database

Audit Logging​

PrimeCal maintains several audit trails:

  • Automation audit log — records every automation rule execution with trigger values, condition evaluation results, and action outcomes (1000-entry circular buffer per rule)
  • Subscription audit log — records subscription plan changes and billing events
  • Database mutation subscriber — records entity-level changes for supported entity types

Access Control​

  • Role-based access control separates System Admin, Admin, and User capabilities
  • Calendar access is enforced at the API level based on ownership and sharing grants — a user cannot access another user's calendar data unless explicitly shared
  • Subscription feature guards (@RequireFeature) enforce plan-based feature access at the API layer when subscriptions are enabled

Vulnerability Reporting​

If you discover a security vulnerability in PrimeCal, please report it responsibly to your system administrator or the development team rather than publicly disclosing it before a fix is available.

note

This whitepaper describes the security architecture of the PrimeCal application codebase. The security of a specific deployment also depends on the infrastructure, hosting environment, and operational practices of the deploying organization. Administrators are responsible for hardening their deployment environment, keeping dependencies updated, and monitoring for new security advisories.