Webdevelop Docs

Appearance

Service: Application Security Framework ​

The Application Security Framework represents the platform's multi-layered, defense-in-depth strategy to protect user identity, assets, data, and the underlying infrastructure itself. It combines user-facing security features with rigorous backend and development ("Armored DevOps") practices to provide comprehensive, verifiable security and resilience against modern threats.

This framework is built on key pillars:

  • Identity Assurance: Implementing phishing-resistant authentication and biometric controls.

  • Asset Protection: Utilizing advanced cryptography and transaction verification to secure user funds and tokens.

  • Data Confidentiality: Ensuring sensitive user information is protected through end-to-end encryption.

  • Platform Integrity: Continuously hardening the codebase, infrastructure, and smart contracts against vulnerabilities and attacks.

  • Verifiable Trust: Providing transparency through processes like public smart contract audits.

Core Technical Components & APIs ​

Security is embedded throughout the platform, involving numerous components:

Primary Models:

  • User Model: Manages authentication credentials (Passkeys, hashed passwords). Track and audit user access.

  • Group: Defines roles and permissions for RBAC.

  • Profile Model: Stores encrypted PII.

  • EVM Wallet Model: Represents the user's interface to the MPC infrastructure.

Governing Logic:

  • Authentication workflows (Passkey verification, biometric checks).

  • Authorization rules based on RBAC.

  • Encryption/Decryption protocols.

  • Transaction simulation and signing procedures.

Primary APIs & Tools:

  • user-api: Handles all user login, registration, and MFA flows. Manages user profile data, including secure PII handling.

  • evm-api(MPC Provider Interface): Interacts with the Multi-Party Computation infrastructure.

  • Internal DevOps Tooling: SCA scanners, Vulnerability Management platforms, IaC tools (Terraform, CloudFormation), Static/Dynamic Analysis Security Testing (SAST/DAST) tools.

Key Capabilities & Features ​

The framework implements security across multiple layers:

Phase 1: User Identity & Access Security ​

Ensuring only legitimate users can access their accounts and perform actions.

  • Phishing-Resistant MFA: The system must support FIDO2/Passkeys as the primary authentication method, tied to device biometrics (Face ID, Touch ID).

  • Biometric Action Gating: Critical actions (e.g., initiating withdrawals, changing security settings) must require re-authentication using device biometrics.

  • Role-Based Access Control (RBAC): Access to platform features and data must be strictly controlled based on the user's assigned Group and permissions.

  • Session Management: The system must securely manage user sessions, provide tools for users to view active sessions, and allow administrators to terminate sessions remotely.

  • Login Auditing: All login attempts (success and failure) must be logged with IP address, device, and location information.

Phase 2: Data & Asset Security ​

Protecting user information and their financial holdings.

  • End-to-End Encrypted PII: Sensitive KYC data must be encrypted on the client-side before transmission and stored using strong encryption (e.g., AES-256) in a secure vault.

  • Multi-Party Computation (MPC) Wallet Infrastructure: User private keys must be managed using MPC, splitting key shares between the user's device, platform servers, and potentially a third-party custodian, eliminating single points of failure like seed phrases while enabling secure account recovery.

  • Transaction Simulation & WYSIWYG: Before signing any blockchain transaction, the system must simulate the transaction's outcome and present a clear, plain-language summary to the user for confirmation, preventing wallet drainer scams.

Phase 3: Platform & Infrastructure Security ​

Securing the code, dependencies, and environment the platform runs on.

  • Secure Software Supply Chain:

    • The build process must utilize Software Composition Analysis (SCA) to identify known vulnerabilities in dependencies.

    • Dependencies must be pinned to specific, audited versions.

  • Continuous Vulnerability Management: The platform must maintain a Software Bill of Materials (SBOM) and continuously scan it against CVE databases, with strict SLAs for patching critical vulnerabilities.

  • Zero Trust Architecture & IaC: Production environments must not allow direct developer access. All infrastructure must be defined and managed via Infrastructure-as-Code, which is itself scanned for security misconfigurations before deployment.

  • Rigorous Smart Contract Audits: All smart contract code must undergo multiple layers of review before deployment: internal peer review, automated formal verification, and multiple independent external audits by reputable security firms. Audit reports should be made publicly available.

Advanced Scenarios & Platform Resilience ​

  • Account Recovery: The framework provides a secure process for users to recover access to their account via the MPC infrastructure even if they lose their primary device.

  • Incident Response: Defined procedures are in place to detect, respond to, and remediate security incidents, including vulnerability disclosures and potential breaches.

  • Compliance Adherence: Security practices are designed to meet or exceed relevant regulatory requirements for financial platforms handling sensitive data and assets.