Skip to content
Kilavuz Kilavuz
Blog

Security and Privacy Guide

This guide summarizes the project-controlled security and privacy surfaces of Kilavuz. The internal form controls of the Wasp SDK remain in English; that exception is a deliberate scope decision and is documented separately in the README.

Authentication

  • All account creation and sign-in operations flow through the authentication layer provided by Wasp. Passwords are stored hashed with bcrypt.
  • Verification emails are sent from noreply@kilavuz.app via the same single sender identity. The DNS and Resend verification records required for that sender domain are listed in docs/deploy/kilavuz-readiness.md.

Session management

  • Session cookies are set with the HttpOnly and Secure flags.
  • In production (kilavuz.app, admin.kilavuz.app), all traffic is forced over HTTPS; HSTS is sent with Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
  • The API layer (api.kilavuz.app) only answers requests from the configured allow-list (CORS_ALLOWED_DOMAINS). The list is parsed at server start; an invalid entry aborts boot and writes to the error log.

Admin separation

admin.kilavuz.app and kilavuz.app share the same source code base but are compiled into different client bundles. The public web nginx configuration returns a hard 404 for the /admin path; in production, curl -o /dev/null -w '%{http_code}' https://kilavuz.app/admin should return 404.

The admin panel side is protected by a server-side isAdmin check. API endpoints reachable by an admin (isAdmin === true) return 403 to ordinary users; that behavior is independent of the user’s chosen language.

  • The cookie consent dialog is driven by the dictionaries in app/src/client/components/cookie-consent/ and updates with the active language.
  • The preference is stored under localStorage["kilavuz.cookie-consent"]; all non-essential cookies are blocked until the preference is set.
  • If the preference key is missing, the dialog renders controlled Turkish content; after switching to English, the dialog text reloads in the new language.

Data retention

  • Ordinary user data lives in Postgres tables defined by the application’s Prisma schema.
  • When a user deletes their account, personal data associated with that user is removed irreversibly; anonymized audit records (for example, billing period metadata) may be retained for the legally required period.
  • Soft-deleted questions remain visible in the project’s own “trash” query and are kept in the database under the deletedAt stamp until the project owner cleans them up permanently.

Skip email verification in development

When the SKIP_EMAIL_VERIFICATION_IN_DEV environment variable is set to true, development and end-to-end test runs skip the email verification step. The variable is only active in development environments; it is ignored in production configuration.

Reporting an incident

Report security issues at security@kilavuz.app. The address currently operates as a forwarder and does not reply to inbound mail; a real distribution address will be published separately in the deployment readiness document.