Built with security at every layer.
From TLS automation to JWT rotation and tenant isolation, DomainDock is designed with a zero-trust model from the ground up.
Security features
Six layers of protection
Every surface of the platform is hardened. Here's exactly what we do and why.
Automated TLS Encryption
All traffic passes through our Traefik gateway with TLS 1.2/1.3. Let's Encrypt certificates are issued automatically and renewed 30 days before expiry. HTTP is permanently redirected to HTTPS with HSTS headers enforced.
- TLS 1.2 and 1.3 only
- Auto-renewal via ACME
- HSTS headers
- HTTP → HTTPS redirect
JWT + Refresh Token Security
Access tokens are short-lived (15 minutes). Refresh tokens use family-based rotation with replay detection: reusing a revoked token immediately invalidates the entire token family. All refresh tokens are stored as secure hashes, never plaintext.
- 15-minute access tokens
- Family-based rotation
- Replay detection
- Hashed token storage
Tenant Isolation
Every data operation validates domain ownership against the authenticated user ID. A user can never read, modify, or delete another user's projects, DNS records, or SSL certificates. Ownership is enforced at every layer of the platform.
- Per-user ownership checks
- Row-level access control
- No cross-tenant data leak
- Secure identifier schemes
Rate Limiting & DDoS Protection
Incoming API requests are rate-limited at the application layer and at the gateway layer. Cloudflare's DDoS protection sits in front of all traffic, providing L3/L4/L7 protection before requests reach our infrastructure.
- Application-layer rate limits
- Gateway-layer rate limits
- Cloudflare L3–L7 DDoS
- Bot challenge pages
Secret Management
No secrets are hardcoded in the platform. All credentials are validated at startup against minimum security requirements. API tokens are scoped to minimum permissions. All secrets are environment variables, never committed to source control.
- Startup credential validation
- Minimum secret length enforced
- Git-ignored credential files
- Principle of least privilege
Audit Trail
All project mutations (create, update, delete) are timestamped and persisted. Session issuance records the user agent and IP address for every login. Database operations use transactions to ensure consistency.
- Timestamped mutations
- Session IP & user agent log
- Transactional operations
- Soft delete patterns
Responsible disclosure
If you discover a security vulnerability in DomainDock, please email security@digitalweb.host with a description of the issue. We will respond within 48 hours, work with you to verify and fix the issue, and credit you in our security changelog.
Please do not publicly disclose vulnerabilities before we have had a chance to address them.