How the platform addresses each of the ten most critical web application security risks.
01Controls by category
| OWASP risk | Mentornity controls |
|---|---|
| A01 Broken Access Control | Server-side authorisation on every route; programme membership checked on administrative routes; per-field visibility for member answers; object ownership checks on updates. |
| A02 Cryptographic Failures | TLS 1.2/1.3 only with HSTS; encrypted disks, snapshots and backups; bcrypt password hashes; HMAC-signed links; secrets in an encrypted parameter store. |
| A03 Injection | Database input validation that rejects operator injection into protected fields; bounded, escaped search patterns; HTML escaped before Markdown rendering; an allow-list sanitiser for rich text. |
| A04 Insecure Design | Threat review for features that touch identity or personal data; rate limits on sign-in and public endpoints; per-organisation API quotas. |
| A05 Security Misconfiguration | Infrastructure as code with a verification gate; deny-by-default network rules; hardened instance metadata access; security headers including a nonce-based Content Security Policy. |
| A06 Vulnerable and Outdated Components | govulncheck and package audits; daily OS security updates; supported runtimes. |
| A07 Identification and Authentication Failures | SAML SSO, Google and Microsoft sign-in; strong password policy; account and IP lockout; uniform error responses; token revocation on password change and “sign out everywhere”. |
| A08 Software and Data Integrity Failures | Deploys only from merged, reviewed commits; signed outgoing webhooks; integrity of e-signed documents verifiable from a QR record. |
| A09 Security Logging and Monitoring Failures | Central logs with 30-day retention; CloudTrail; alarms and an external dead-man’s-switch probe. |
| A10 Server-Side Request Forgery | Integration callback hosts checked against an allow-list; user-supplied URLs validated to http(s) before use; outbound webhook calls require TLS. |
02Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.