SiCierto Platform Security
Version 1.1 | March 2026
Overview
SiCierto is built on enterprise-grade infrastructure with multiple layers of security to protect users, their data, and the platform from threats including DDoS attacks, data breaches, and unauthorized access.
1. Infrastructure Security
1.1 Hosting & DDoS Protection
SiCierto is hosted on Google Cloud Platform (GCP), providing:
| Security Feature | Description |
|---|---|
| Google Cloud Armor | Enterprise-grade DDoS protection |
| Global Load Balancing | Traffic distribution and attack mitigation |
| Automatic Scaling | Handles traffic spikes without service interruption |
| Geographic Distribution | Data centers worldwide for redundancy |
DDoS Attack Protection:
- Automatic detection and mitigation of volumetric attacks
- Layer 3, 4, and 7 attack protection
- Real-time traffic analysis and filtering
- No additional configuration required - protection is built-in
1.2 Data Encryption
| Data State | Encryption Standard |
|---|---|
| Data in Transit | TLS 1.2+ (HTTPS) |
| Data at Rest | AES-256 server-side encryption |
| Database | Google Cloud SQL with secure key management |
1.3 Compliance & Certifications
- SOC 2 Type 2 Attestation of Compliance
- Enterprise-grade backup and recovery systems
- Regular security audits and penetration testing
1.4 Geo-blocking
SiCierto implements IP-based geo-blocking as part of its compliance measures:
| Country | Status | Reason |
|---|---|---|
| Nigeria (NG) | BLOCKED | Regulatory compliance |
| Ghana (GH) | BLOCKED | Regulatory compliance |
Users from blocked regions will see an access denied page and cannot use the platform.
2. API Security
2.1 Rate Limiting
Our APIs implement rate limiting to prevent abuse and flood attacks:
| Endpoint Type | Rate Limit | Purpose |
|---|---|---|
| Authentication APIs | 10 requests/minute per IP | Prevent brute force attacks |
| Chat/Discord APIs | 30 requests/minute per IP | Prevent spam |
| Game APIs | 60 requests/minute per IP | Fair gameplay |
| General APIs | 100 requests/minute per IP | Standard protection |
| Video Repo Upload | 10 uploads/minute per IP | Prevent storage abuse |
What happens when limits are exceeded:
- Request is rejected with HTTP 429 "Too Many Requests"
- Error message indicates when to retry
- Standard rate limit headers are included in responses
- IP is temporarily blocked for that endpoint type
2.2 API Key Protection
- All API keys are stored as encrypted secrets
- Keys are never exposed in client-side code
- Environment variables are used for secure access
- Automatic key rotation capabilities
2.3 Admin Endpoint Authentication
All admin and sensitive endpoints require Bearer token authentication:
| Header | Format |
|---|---|
| Authorization | Bearer <ADMIN_API_KEY> |
| X-API-Key | <VIDEO_REPO_API_KEY> (for Video Repository) |
Protected endpoints include:
/api/admin/auto-questions/*/api/repo/*(Video Repository)/api/chat/upload-attachment/api/chat/send-transcript
2.4 Input Validation
- All API inputs are validated and sanitized
- SQL injection protection via parameterized queries
- XSS (Cross-Site Scripting) prevention
- CSRF (Cross-Site Request Forgery) protection
- HTML escaping applied to all external data (including VPS webhook payloads)
3. AI Security
3.1 AI Integration Security
SiCierto uses AI for educational content generation with these protections:
| Security Measure | Implementation |
|---|---|
| Provider Credential Management | Replit manages AI provider credentials securely |
| No Direct Key Exposure | API keys never exposed to client-side code |
| Encrypted Secrets | All AI API keys stored in encrypted vault |
| Secure Environment Variables | Keys accessible only as server-side env vars |
3.2 AI Content Safety
- Content filtering for inappropriate material
- Educational focus enforcement
- Rate limiting to prevent abuse
- No storage of personal data in AI prompts
3.3 Supported AI Providers
All AI integrations use enterprise-grade security:
| Provider | Security Features |
|---|---|
| OpenAI | SOC 2 compliant, encrypted at rest and in transit |
| Anthropic | Constitutional AI, privacy-focused |
4. Token Security
4.1 $SiCiCoin Contract Security
The following current-mint properties were observed on-chain on September 10, 2026. They are not a security audit, risk rating, or guarantee of safety:
| Security Measure | Status |
|---|---|
| Mint Authority | REVOKED ✅ — No new tokens can ever be created |
| Freeze Authority | REVOKED ✅ — No tokens can ever be frozen |
| Market | Pump.fun market/pool observed |
These revocations are permanent and irreversible on the Solana blockchain.
4.2 Independent Data Links
The landing page links to independent data services so readers can inspect current information. A listing or available report is not represented here as verification or endorsement:
| Platform | Purpose |
|---|---|
| Token Sniffer | Third-party token data |
| SolSniffer | Third-party token data |
| RugCheck | Third-party token report |
| Solscan | Solana explorer |
| Birdeye | Market data |
4.3 Token Details
| Property | Value |
|---|---|
| Mint Address | kSpz2Bu7tjBTgrdQbX9VUoXWZucF8fZBGGioHH2pump |
| Platform Wallet | CTJsCnDzbBD9tBwfgA5aJTUtDZrXpF6sW8iPsGGVjFwH |
CTJs is the platform/creator wallet, not a token mint.
4.4 Historical and Unconfirmed Addresses
BskE7eyNWD2rnsTTNXe719vC6wLm3rWUFWmgoHAo5i9Kis a separate Solana mint with a historical website association through a Version 1.4 purchase link. It is not the current website-designated mint.BxSjd85LdhgYJV3VEv6kx6xWzPDEpB5Dc79HBke97uq5is the historical Raydium WSOL/BskE pool account, not a mint.0x0B806080B34a8eA097C9a858c0C1a6410c11FCF2exists as an Ethereum ERC-20 contract, but its relationship to SiCierto is unconfirmed by the current website. It is not presented as an official/current address.
5. User Data Protection
5.1 Authentication Security
| Feature | Protection |
|---|---|
| Session Management | Secure, encrypted session tokens |
| Wallet Connection | Non-custodial - we never access your private keys |
| Password Hashing | bcrypt with salt (for game accounts) |
| OAuth Integration | Secure third-party authentication |
5.2 Wallet Security
SiCierto is non-custodial:
- We NEVER store or access your wallet private keys
- Wallet connections are read-only for public address
- All transactions require your explicit wallet approval
- You maintain full control of your assets at all times
5.3 Data Privacy
| Data Type | Handling |
|---|---|
| Wallet Addresses | Stored for points tracking only |
| Game Scores | Associated with wallet, no personal info |
| Chat Messages | Encrypted, auto-deleted after 30 days |
| Analytics | Anonymized, no personally identifiable info |
6. Security Scanning
6.1 Automated Security Scans
The platform includes built-in security scanning:
| Scanner | Purpose |
|---|---|
| Dependency Vulnerability Scanner | Identifies vulnerable npm packages |
| Static Analysis (Semgrep) | Detects code security issues |
| Malicious File Detection | Scans for harmful content |
| Privacy Scanner (HoundDog.ai) | Identifies potential data leaks |
6.2 Code Security
- All scanning runs locally on secure infrastructure
- Code and data are NOT sent to third parties
- Automatic alerts for critical vulnerabilities
- Regular dependency updates
7. Incident Response
7.1 Monitoring
- 24/7 automated monitoring
- Real-time alerting for anomalies
- Performance and security dashboards
- Automatic incident escalation
7.2 Recovery
| Measure | Implementation |
|---|---|
| Automated Backups | Regular snapshots of all data |
| Point-in-Time Recovery | Database restoration capability |
| Disaster Recovery | Multi-region failover |
| Rollback Support | Code and data rollback to checkpoints |
8. Best Practices for Users
8.1 Wallet Security
- Use a Hardware Wallet for large $SiCiCoin holdings
- Never share your seed phrase with anyone
- Verify transaction details before signing
- Use unique passwords for game accounts
8.2 Browser Security
- Keep your browser updated for latest security patches
- Use official wallet extensions from verified sources
- Be cautious of phishing sites - always verify the URL
- Enable 2FA where available
8.3 Reporting Security Issues
If you discover a security vulnerability, please report it responsibly:
- Email: security@sicierto.com
- Do NOT publicly disclose before we've addressed it
- We appreciate responsible disclosure
9. Summary
SiCierto prioritizes security at every level:
| Layer | Protection |
|---|---|
| Infrastructure | Google Cloud Platform with Cloud Armor DDoS protection |
| Data | AES-256 encryption at rest, TLS 1.2+ in transit |
| AI | Managed credentials, encrypted secrets, no key exposure |
| Wallet | Non-custodial, read-only connection, user-controlled |
| Token | Dated mint/freeze authority observations and links to current third-party data |
| Compliance | SOC 2 Type 2 certified infrastructure, geo-blocking |
| API | Bearer token auth for admin endpoints, rate limiting |
| Monitoring | 24/7 automated security monitoring and scanning |
Your security is our priority. The platform is designed with defense-in-depth principles to protect you while you learn and earn.
Last Updated: March 1, 2026