Demo. Raccoon Hub is a portfolio project and is not sold commercially. Payments run in test mode (PayPal sandbox); no real transactions.
Raccoon Hub

Security & Vulnerability Disclosure

Effective October 30, 2026 · Raccoon Hub — [PROJECT OWNER NAME] · [CONTACT EMAIL]

This is a portfolio demo. The policies are written as they would be for a real product, for illustration, but no commercial transactions take place yet.

Raccoon Hub holds access to many websites at once, so security was designed in from the start rather than added later.

1. Accounts

  • Two-factor authentication (TOTP) is mandatory for every user; each code can be used only once.
  • Passwords are hashed with scrypt and never stored in readable form.
  • Accounts lock for 15 minutes after 5 wrong password or 2FA attempts.
  • Sessions expire after 12 hours; the session cookie is sent only over HTTPS and cannot be read by JavaScript.
  • Admin / Editor / Viewer roles; each customer’s data is fully isolated.

2. Website connections

  • The Raccoon Hub Connector plugin creates a dedicated Editor user with its own Application Password; your login password is never used. That user cannot install plugins, change site settings, post unfiltered HTML or sign in through the login form, and deactivating the plugin revokes its access.
  • Sites connect with a one-time pairing code that expires after 72 hours and only works for the website address you registered.
  • Application Passwords, 2FA secrets and connector keys are encrypted with AES-256-GCM before storage; the decryption key lives separately in a server environment variable.
  • The plugin only answers requests signed with HMAC-SHA256 and a timestamp (valid for 5 minutes), preventing forgery and replay.
  • The server refuses to connect to internal network addresses, preventing SSRF attacks.
  • Every write action is logged with who performed it and when.

3. Payments

  • No card details are stored. A plan is activated only after the server verifies the payment itself with PayPal or on the Tron chain, never trusting data from the browser.
  • PayPal webhooks are signature-verified, and each transaction is recorded only once.

4. Infrastructure

  • Runs on DigitalOcean App Platform (Singapore) with HTTPS enforced; the managed PostgreSQL database only accepts connections from the app.
  • Automatic daily database backups.

5. Reporting a vulnerability

If you find a vulnerability, please email [CONTACT EMAIL] with the subject “[Security]”, including a description, steps to reproduce and the impact.

  • We acknowledge reports within 3 working days and keep you updated on progress.
  • Only test against your own account; do not access, modify or delete other people’s data; no denial-of-service attacks.
  • Do not disclose publicly before the issue is fixed. Researchers who follow this process will not face legal action and will be credited if they wish.