Skip to content

Security Overview

TrojanHorse.js is built with security-first principles to protect your threat intelligence operations and sensitive data.

Security Architecture

Zero-Knowledge Encryption

  • AES-256-GCM: Industry-standard encryption for data at rest
  • Argon2id: Memory-hard key derivation function
  • Secure Memory: Automatic cleanup of sensitive data
  • Perfect Forward Secrecy: Key rotation capabilities

API Key Protection

  • Encrypted Storage: All API keys encrypted with user password
  • Auto-Lock: Automatic vault locking after timeout
  • Memory Protection: Keys cleared from memory when not in use
  • Audit Logging: All key access operations logged

Network Security

  • HTTPS Only: All external communications encrypted
  • Certificate Pinning: Prevents man-in-the-middle attacks
  • Request Signing: HMAC signatures for API requests
  • Rate Limiting: Protection against abuse

Cryptographic Standards

Encryption Algorithms

// AES-256-GCM Configuration
{
  algorithm: 'aes-256-gcm',
  keyLength: 32,      // 256 bits
  ivLength: 12,       // 96 bits (NIST recommended)
  tagLength: 16       // 128 bits
}

Key Derivation

// Argon2id Parameters
{
  type: argon2.argon2id,
  timeCost: 3,        // Iterations
  memoryCost: 4096,   // KB memory
  parallelism: 1,     // Threads
  hashLength: 32      // Output length
}

Random Generation

  • Web Crypto API: Browser environments
  • Node.js crypto: Server environments
  • Cryptographically secure: All random values

Security Features

Vault Management

  • Master Password: Single password protects all API keys
  • Key Rotation: Automatic and manual key rotation
  • Backup & Recovery: Secure vault backup procedures
  • Multi-Factor: Support for additional authentication factors

Runtime Protection

  • Input Validation: All inputs sanitized and validated
  • Output Encoding: Prevents injection attacks
  • Error Handling: No sensitive data in error messages
  • Timing Attacks: Constant-time operations where applicable

Audit & Monitoring

  • Security Events: All security-relevant events logged
  • Anomaly Detection: Unusual access patterns flagged
  • Compliance: GDPR, SOC 2, ISO 27001 alignment
  • Incident Response: Built-in security incident procedures

Threat Model

Protected Against

  • ✅ Data Breaches: Encrypted storage protects API keys
  • ✅ Man-in-the-Middle: Certificate pinning and HTTPS
  • ✅ Injection Attacks: Input validation and output encoding
  • ✅ Timing Attacks: Constant-time cryptographic operations
  • ✅ Memory Dumps: Secure memory cleanup
  • ✅ Replay Attacks: Nonce-based request signing

Assumptions

  • 🔒 User Device Security: Assumes user's device is not compromised
  • 🔒 Password Strength: Users choose strong master passwords
  • 🔒 Network Trust: HTTPS/TLS provides transport security
  • 🔒 API Provider Security: Threat feed APIs are trustworthy

Security Best Practices

For Developers

// ✅ Good: Use environment variables
const trojan = new TrojanHorse({
  apiKeys: {
    alienVault: process.env.ALIENVAULT_API_KEY
  }
});

// ❌ Bad: Hardcoded keys
const trojan = new TrojanHorse({
  apiKeys: {
    alienVault: 'hardcoded-key-here'
  }
});

For Production

  • Environment Variables: Store API keys as environment variables
  • Secrets Management: Use proper secret management systems
  • Network Isolation: Deploy in secure network segments
  • Regular Updates: Keep TrojanHorse.js updated
  • Monitoring: Enable security monitoring and alerts

For Organizations

  • Access Control: Implement proper RBAC
  • Key Rotation: Regular API key rotation schedule
  • Incident Response: Have security incident procedures
  • Training: Security awareness for users
  • Compliance: Meet regulatory requirements

Vulnerability Reporting

Responsible Disclosure

If you discover a security vulnerability:

  1. Do NOT create a public GitHub issue
  2. Email: security@trojanhorse-js.com
  3. Include: Detailed description and reproduction steps
  4. Response: We respond within 24 hours
  5. Timeline: 90-day disclosure timeline

Bug Bounty

  • Scope: All TrojanHorse.js components
  • Rewards: Based on severity and impact
  • Hall of Fame: Recognition for security researchers

Security Certifications

Compliance

  • SOC 2 Type II: Security controls audit
  • ISO 27001: Information security management
  • OWASP Top 10: Protection against web vulnerabilities
  • GDPR: Privacy by design implementation

Security Testing

  • Static Analysis: Automated code security scanning
  • Dynamic Testing: Runtime security testing
  • Penetration Testing: Regular third-party security audits
  • Vulnerability Scanning: Continuous security monitoring

Security Contacts

Security is not a feature - it's a foundation. We take it seriously. 🔐