# SiCierto Platform Security

**Version 1.1 | March 2026**

---

## Overview

SiCierto is built on enterprise-grade infrastructure with multiple layers of security to protect users, their data, and the platform from threats including DDoS attacks, data breaches, and unauthorized access.

---

## 1. Infrastructure Security

### 1.1 Hosting & DDoS Protection

SiCierto is hosted on **Google Cloud Platform (GCP)**, providing:

| Security Feature | Description |
|-----------------|-------------|
| **Google Cloud Armor** | Enterprise-grade DDoS protection |
| **Global Load Balancing** | Traffic distribution and attack mitigation |
| **Automatic Scaling** | Handles traffic spikes without service interruption |
| **Geographic Distribution** | Data centers worldwide for redundancy |

**DDoS Attack Protection:**
- Automatic detection and mitigation of volumetric attacks
- Layer 3, 4, and 7 attack protection
- Real-time traffic analysis and filtering
- No additional configuration required - protection is built-in

### 1.2 Data Encryption

| Data State | Encryption Standard |
|------------|-------------------|
| Data in Transit | TLS 1.2+ (HTTPS) |
| Data at Rest | AES-256 server-side encryption |
| Database | Google Cloud SQL with secure key management |

### 1.3 Compliance & Certifications

- **SOC 2 Type 2** Attestation of Compliance
- Enterprise-grade backup and recovery systems
- Regular security audits and penetration testing

### 1.4 Geo-blocking

SiCierto implements IP-based geo-blocking as part of its compliance measures:

| Country | Status | Reason |
|---------|--------|--------|
| Nigeria (NG) | **BLOCKED** | Regulatory compliance |
| Ghana (GH) | **BLOCKED** | Regulatory compliance |

Users from blocked regions will see an access denied page and cannot use the platform.

---

## 2. API Security

### 2.1 Rate Limiting

Our APIs implement rate limiting to prevent abuse and flood attacks:

| Endpoint Type | Rate Limit | Purpose |
|--------------|------------|---------|
| Authentication APIs | 10 requests/minute per IP | Prevent brute force attacks |
| Chat/Discord APIs | 30 requests/minute per IP | Prevent spam |
| Game APIs | 60 requests/minute per IP | Fair gameplay |
| General APIs | 100 requests/minute per IP | Standard protection |
| Video Repo Upload | 10 uploads/minute per IP | Prevent storage abuse |

**What happens when limits are exceeded:**
- Request is rejected with HTTP 429 "Too Many Requests"
- Error message indicates when to retry
- Standard rate limit headers are included in responses
- IP is temporarily blocked for that endpoint type

### 2.2 API Key Protection

- All API keys are stored as encrypted secrets
- Keys are never exposed in client-side code
- Environment variables are used for secure access
- Automatic key rotation capabilities

### 2.3 Admin Endpoint Authentication

All admin and sensitive endpoints require Bearer token authentication:

| Header | Format |
|--------|--------|
| Authorization | `Bearer <ADMIN_API_KEY>` |
| X-API-Key | `<VIDEO_REPO_API_KEY>` (for Video Repository) |

Protected endpoints include:
- `/api/admin/auto-questions/*`
- `/api/repo/*` (Video Repository)
- `/api/chat/upload-attachment`
- `/api/chat/send-transcript`

### 2.4 Input Validation

- All API inputs are validated and sanitized
- SQL injection protection via parameterized queries
- XSS (Cross-Site Scripting) prevention
- CSRF (Cross-Site Request Forgery) protection
- HTML escaping applied to all external data (including VPS webhook payloads)

---

## 3. AI Security

### 3.1 AI Integration Security

SiCierto uses AI for educational content generation with these protections:

| Security Measure | Implementation |
|-----------------|----------------|
| **Provider Credential Management** | Replit manages AI provider credentials securely |
| **No Direct Key Exposure** | API keys never exposed to client-side code |
| **Encrypted Secrets** | All AI API keys stored in encrypted vault |
| **Secure Environment Variables** | Keys accessible only as server-side env vars |

### 3.2 AI Content Safety

- Content filtering for inappropriate material
- Educational focus enforcement
- Rate limiting to prevent abuse
- No storage of personal data in AI prompts

### 3.3 Supported AI Providers

All AI integrations use enterprise-grade security:

| Provider | Security Features |
|----------|------------------|
| **OpenAI** | SOC 2 compliant, encrypted at rest and in transit |
| **Anthropic** | Constitutional AI, privacy-focused |

---

## 4. Token Security

### 4.1 $SiCiCoin Contract Security

The following current-mint properties were observed on-chain on September 10, 2026. They are not a security audit, risk rating, or guarantee of safety:

| Security Measure | Status |
|-----------------|--------|
| **Mint Authority** | REVOKED ✅ — No new tokens can ever be created |
| **Freeze Authority** | REVOKED ✅ — No tokens can ever be frozen |
| **Market** | Pump.fun market/pool observed |

These revocations are **permanent and irreversible** on the Solana blockchain.

### 4.2 Independent Data Links

The landing page links to independent data services so readers can inspect current information. A listing or available report is not represented here as verification or endorsement:

| Platform | Purpose |
|----------|-------------|
| Token Sniffer | Third-party token data |
| SolSniffer | Third-party token data |
| RugCheck | Third-party token report |
| Solscan | Solana explorer |
| Birdeye | Market data |

### 4.3 Token Details

| Property | Value |
|----------|-------|
| Mint Address | `kSpz2Bu7tjBTgrdQbX9VUoXWZucF8fZBGGioHH2pump` |
| Platform Wallet | `CTJsCnDzbBD9tBwfgA5aJTUtDZrXpF6sW8iPsGGVjFwH` |

CTJs is the platform/creator wallet, not a token mint.

### 4.4 Historical and Unconfirmed Addresses

- `BskE7eyNWD2rnsTTNXe719vC6wLm3rWUFWmgoHAo5i9K` is a separate Solana mint with a historical website association through a Version 1.4 purchase link. It is not the current website-designated mint.
- `BxSjd85LdhgYJV3VEv6kx6xWzPDEpB5Dc79HBke97uq5` is the historical Raydium WSOL/BskE pool account, not a mint.
- `0x0B806080B34a8eA097C9a858c0C1a6410c11FCF2` exists as an Ethereum ERC-20 contract, but its relationship to SiCierto is unconfirmed by the current website. It is not presented as an official/current address.

---

## 5. User Data Protection

### 5.1 Authentication Security

| Feature | Protection |
|---------|-----------|
| **Session Management** | Secure, encrypted session tokens |
| **Wallet Connection** | Non-custodial - we never access your private keys |
| **Password Hashing** | bcrypt with salt (for game accounts) |
| **OAuth Integration** | Secure third-party authentication |

### 5.2 Wallet Security

SiCierto is **non-custodial**:

- We NEVER store or access your wallet private keys
- Wallet connections are read-only for public address
- All transactions require your explicit wallet approval
- You maintain full control of your assets at all times

### 5.3 Data Privacy

| Data Type | Handling |
|-----------|---------|
| **Wallet Addresses** | Stored for points tracking only |
| **Game Scores** | Associated with wallet, no personal info |
| **Chat Messages** | Encrypted, auto-deleted after 30 days |
| **Analytics** | Anonymized, no personally identifiable info |

---

## 6. Security Scanning

### 6.1 Automated Security Scans

The platform includes built-in security scanning:

| Scanner | Purpose |
|---------|---------|
| **Dependency Vulnerability Scanner** | Identifies vulnerable npm packages |
| **Static Analysis (Semgrep)** | Detects code security issues |
| **Malicious File Detection** | Scans for harmful content |
| **Privacy Scanner (HoundDog.ai)** | Identifies potential data leaks |

### 6.2 Code Security

- All scanning runs locally on secure infrastructure
- Code and data are NOT sent to third parties
- Automatic alerts for critical vulnerabilities
- Regular dependency updates

---

## 7. Incident Response

### 7.1 Monitoring

- 24/7 automated monitoring
- Real-time alerting for anomalies
- Performance and security dashboards
- Automatic incident escalation

### 7.2 Recovery

| Measure | Implementation |
|---------|---------------|
| **Automated Backups** | Regular snapshots of all data |
| **Point-in-Time Recovery** | Database restoration capability |
| **Disaster Recovery** | Multi-region failover |
| **Rollback Support** | Code and data rollback to checkpoints |

---

## 8. Best Practices for Users

### 8.1 Wallet Security

1. **Use a Hardware Wallet** for large $SiCiCoin holdings
2. **Never share your seed phrase** with anyone
3. **Verify transaction details** before signing
4. **Use unique passwords** for game accounts

### 8.2 Browser Security

1. **Keep your browser updated** for latest security patches
2. **Use official wallet extensions** from verified sources
3. **Be cautious of phishing sites** - always verify the URL
4. **Enable 2FA** where available

### 8.3 Reporting Security Issues

If you discover a security vulnerability, please report it responsibly:

- Email: security@sicierto.com
- Do NOT publicly disclose before we've addressed it
- We appreciate responsible disclosure

---

## 9. Summary

SiCierto prioritizes security at every level:

| Layer | Protection |
|-------|-----------|
| **Infrastructure** | Google Cloud Platform with Cloud Armor DDoS protection |
| **Data** | AES-256 encryption at rest, TLS 1.2+ in transit |
| **AI** | Managed credentials, encrypted secrets, no key exposure |
| **Wallet** | Non-custodial, read-only connection, user-controlled |
| **Token** | Dated mint/freeze authority observations and links to current third-party data |
| **Compliance** | SOC 2 Type 2 certified infrastructure, geo-blocking |
| **API** | Bearer token auth for admin endpoints, rate limiting |
| **Monitoring** | 24/7 automated security monitoring and scanning |

Your security is our priority. The platform is designed with defense-in-depth principles to protect you while you learn and earn.

---

*Last Updated: March 1, 2026*