Security
Security by design, not afterthought.
Every layer of Underdawn is built with security as a requirement, not a feature. Here's exactly how we protect your data and credentials.
Core protections
How we protect your data
AES-256 Encryption at Rest
Your Dice credentials are encrypted using AES-256 via Fernet symmetric encryption before storage. The encryption key is derived from your account's secret key using SHA-256. Credentials are decrypted only at the exact moment the bot needs to log in, and never stored in plaintext, logged, or transmitted unencrypted.
HTTPS & TLS Everywhere
All traffic between your browser and Underdawn is encrypted via TLS 1.2 or higher. This covers every page, every API request, and every webhook. There is no mixed-content or plaintext fallback. HTTPS is enforced at the infrastructure level by Railway.
Stripe Payments — PCI-DSS
All payment processing is handled entirely by Stripe's PCI-DSS Level 1 certified infrastructure. Underdawn never sees, touches, or stores your card number, expiry, or CVV. Stripe tokens and subscription IDs are the only payment data we store. Webhooks are verified by HMAC signature before processing.
Password Handling
Account passwords are hashed using bcrypt with automatic salting. We never store plaintext passwords. Password comparison uses constant-time functions to prevent timing attacks. If you forget your password, it cannot be recovered — only reset.
Infrastructure Security
Underdawn runs on Railway cloud infrastructure with isolated containers, private networking for database access, and no public database exposure. PostgreSQL is accessed only via internal private network. All secrets are environment variables — never in code or version control.
Rate Limiting & CSRF Protection
Sensitive endpoints are rate-limited per user per minute to prevent brute force. Credential-saving endpoints include same-host Origin/Referer checks to block cross-site request forgery. The bot start endpoint is limited to 5 requests per minute per user.
Data handling
What we store
- Email address (your login)
- Bcrypt password hash
- AES-256 encrypted Dice credentials
- Uploaded resume file
- Profile preferences (JSON)
- Application history (verified submissions)
- Stripe customer and subscription ID
What we never do
- Store or log your Dice password in plaintext
- Sell or share your personal data
- Store your card number or CVV
- Use your resume for any purpose other than applying
- Access your Dice account for any purpose other than applying
- Retain data after account deletion
Compliance roadmap
Active
AES-256 encryption
All credentials encrypted at rest
Active
Stripe PCI-DSS
Level 1 certified payment processing
Active
HTTPS / TLS
All traffic encrypted in transit
Planned
Two-Factor Authentication
TOTP-based 2FA for user accounts
Planned
Audit Logging
Full activity log per user account
Roadmap
SOC 2 Type II
Enterprise compliance certification
Responsible Disclosure
If you discover a security vulnerability in Underdawn, we ask that you report it responsibly so we can address it before it can be exploited. We appreciate the security research community and will respond to all valid reports promptly.
01
Report privately
02
We acknowledge within 48h
03
We investigate & patch
04
We notify you when resolved
Please include a detailed description, steps to reproduce, and potential impact. We ask that you do not publicly disclose the vulnerability until we have had reasonable time to investigate and patch.