Skip to main content
Internal Documentation Only: If you’re not a Null Tools developer, you can close this documentation or visit the Apps section to learn more about using Null Pass in your applications.

​
Security Architecture

Null Pass implements multiple layers of security to protect user data and system integrity.

​
Authentication Security

Algorithm: bcrypt with 10 rounds
  • Passwords are never stored in plain text
  • Each password has unique salt
  • Hash comparison prevents timing attacks
  • Minimum 8 characters required
Token Structure:
  • Contains userId and email
  • Signed with JWT_SECRET
  • Expires after 7 days (configurable)
  • Stored in database with encrypted IP
Security:
  • Tokens validated on every request
  • Expired tokens rejected
  • No token refresh mechanism (re-login required)
Implementation: TOTP (Time-based One-Time Password)
  • 6-digit codes, 30-second period
  • Window of 2 (allows clock drift)
  • Secret stored in database
  • QR code generation for easy setup

​
Data Protection

IP addresses are encrypted before storage:
  • User-specific encryption key
  • Decrypted only for display to same user
  • Prevents IP tracking across users
  • Encryption key derived from user ID
Implementation: lib/ip-utils.ts
  • Never logged or exposed
  • Hashed with bcrypt before storage
  • No password history kept
  • Current password required for changes
Protected data:
  • Passwords (hashed)
  • 2FA secrets (stored, encrypted at rest if DB encryption enabled)
  • IP addresses (encrypted)
  • JWT tokens (not logged)

​
Request Protection

Multi-layer protection:
  • Rate limiting (token bucket)
  • Bot detection
  • Shield protection
  • Email validation
  • Sensitive info detection
Cross-Origin Resource Sharing:
  • Validates origin headers
  • Returns appropriate CORS headers
  • Prevents unauthorized cross-origin requests
All inputs validated with Zod:
  • Type checking
  • Format validation
  • Length limits
  • Required field checks

​
Session Security

  • Sessions expire after 7 days
  • IP address tracked (encrypted)
  • Users can view and revoke sessions
  • Session reuse for same IP
  • Automatic expiration cleanup
  • Stored in database (PostgreSQL)
  • Token stored with session
  • IP address encrypted
  • Expiration tracked
  • Cascade delete on user deletion

​
Audit Logging

All critical actions are logged:
  • User registration
  • Login/logout
  • Password changes
  • 2FA enable/disable
  • Profile updates
  • Session creation/deletion
  • Service access changes
Audit Log Fields:
  • Action type (AuditAction enum)
  • User ID
  • Timestamp
  • Additional data (JSON)

​
Account Security

Users can be banned:
  • banned flag in database
  • Prevents all authentication
  • Logged in audit trail
Users can be disabled:
  • disabled flag in database
  • Prevents authentication
  • Separate from ban (different use case)

​
Environment Security

​
JWT_SECRET
string
required
Must be strong, random secret. Never commit to version control.
​
DATABASE_URL
string
required
Use connection string with SSL in production.
​
ARCJET_KEY
string
required
Keep Arcjet API key secure.

​
Best Practices

For Production:
  • Use strong JWT_SECRET (minimum 32 characters, random)
  • Enable database encryption at rest
  • Use HTTPS only
  • Regularly rotate secrets
  • Monitor audit logs
  • Keep dependencies updated
  • Never log passwords or tokens
  • Use environment variables for secrets
  • Implement proper CORS policies
  • Regular security audits
  • Monitor failed login attempts

​
Security Checklist

Use this checklist to verify all security measures are properly configured before deploying to production:
  • Strong JWT_SECRET configured
  • Database uses SSL connection
  • HTTPS enforced in production
  • CORS properly configured
  • Rate limiting active
  • Audit logging enabled
  • Regular security updates
  • Secrets not in version control
  • Database backups encrypted
  • Error messages don’t leak sensitive info
You can check off items in this checklist as you verify each security measure. This helps ensure nothing is missed during deployment.