Security

Kleia takes the security of your data seriously. This page outlines the security measures we have implemented to protect your information.

Encryption

All traffic to and from Kleia is encrypted using TLS 1.3. Passwords are hashed using SHA-256 before being stored in the database — we never store plaintext passwords. Flag values in CTF challenges are also stored as SHA-256 hashes, never in plaintext.

Database Security

We use PostgreSQL Row-Level Security (RLS) to enforce data isolation. Every database query is scoped to the authenticated user, meaning users can only access data they own or data explicitly marked as public. Even server-side actions check user permissions before executing.

• Users can only read and write their own profile data.
• Posts and comments are publicly readable but only editable by their authors.
• Private messages are only visible to conversation participants.
• CTF submissions are only visible to the submitting user and administrators.

Authentication

Authentication is handled by Supabase Auth, which provides secure password-based authentication and OAuth (Google, GitHub). Session tokens are HTTP-only cookies, reducing the risk of XSS-based token theft. Email confirmation is required for new accounts.

Audit Logging

All server actions (post creation, likes, CTF flag submissions, admin operations) are logged to an internal events table with timestamps. This allows administrators to investigate suspicious activity and diagnose issues. These logs are only accessible to administrators.

Open Source

Kleia is open source. The full source code is available on GitHub at github.com/LikeNmuFF/kleia.py. This means the code is publicly auditable — anyone can review the security implementations, dependency choices, and data handling practices.

Third-Party Services

Kleia uses the following third-party services, each with their own security and compliance certifications:

• Supabase — Database and authentication provider. Data is hosted on AWS infrastructure. SOC 2 compliant.
• Cloudinary — Image and file hosting for user uploads. SOC 2 compliant.
• Vercel — Application hosting and deployment.

Reporting Vulnerabilities

If you discover a security vulnerability in Kleia, please report it privately by contacting the project maintainer. Do not disclose vulnerabilities publicly until they have been addressed.