How We Secured DEAS — A Practical Security Audit Guide
Why Security Matters
When you run a web platform that handles user data and connects to AI services, security isn’t optional — it’s foundational.
We recently completed a comprehensive security audit of DEAS. Here’s what we found and how we fixed it.
The Audit
We scanned for:
- Port exposure — what services are accessible from the outside
- Security headers — X-Frame-Options, HSTS, CSP, and more
- CORS configuration — who can access our API
- Sensitive file exposure — can .env, source code, or user data be read
- Authentication hardening — rate limiting, brute force protection
- Dependency vulnerabilities — npm audit
What We Found
🔴 Critical: Missing Clickjacking Protection
The site had no X-Frame-Options header — anyone could embed DEAS in an iframe and trick users.
🟠 High: No HSTS, Wide Open CORS
Without Strict-Transport-Security, users were vulnerable to SSL stripping attacks. Our CORS config allowed any .trycloudflare.com domain — a wildcard that’s too permissive.
🟡 Medium: Port Exposure, Weak JWT Secret
The server listened on 0.0.0.0 instead of 127.0.0.1, and the JWT signing key regenerated on every restart, logging out all users.
The Fixes
| Issue | Fix |
|---|---|
| Clickjacking | Added X-Frame-Options: DENY |
| SSL stripping | Added Strict-Transport-Security: max-age=63072000 |
| XSS | Added X-XSS-Protection + Content-Security-Policy |
| CORS wildcard | Restricted to only deassystems.com |
| Port exposure | Changed from 0.0.0.0 to 127.0.0.1 |
| JWT secret | Stored persistent key in environment |
| Brute force | Rate limiting on auth endpoints (10 req/min/IP) |
| Attack paths | Blocked wp-admin, phpmyadmin, config, etc. |
| Server info | Removed Python/uvicorn from headers |
| Security contact | Added security.txt for responsible disclosure |
Tools We Used
We tested everything with:
- curl for header inspection
- netstat for port scanning
- Google’s OAuth test endpoint for token exchange validation
- npm audit for dependency checks
- Browser dev tools for clickjacking and CORS testing
Results
All sensitive files (.env, source code, user database) now return 404. Attack paths return 403. Auth endpoints are rate-limited. The blog has security headers via Cloudflare Pages _headers file.
Security is an ongoing process — we’ll keep auditing and improving.
Have questions about securing your own platform? Contact us at nicolaasgrey@gmail.com