Defense in Depth

Security Architecture

A personal journal demands the highest bar of engineering trust. Here is a transparent breakdown of the technical safeguards protecting your data at every layer.

Infrastructure: Containerized FrankenPHP • Caddy TLS 1.3 • Zero Plaintext Logging

Encryption at Rest

AES-256-CBC

External API credentials and tokens are encrypted with OpenSSL AES-256 before disk writes.

Transit Security

TLS 1.3 / HSTS

All network connections require TLS 1.3 with automated certificate renewals and strict HTTPS.

Access Segregation

Row-Level Gating

Every database query enforces strict authenticated user scoping; cross-tenant access is impossible.

Cryptographic Standards & Key Management

Lumina utilizes modern authenticated cryptography to ensure secrets cannot be recovered by unauthorized actors:

API Key Protection (BYOK)

Gemini and ElevenLabs keys are encrypted using OpenSSL AES-256-CBC with randomized initialization vectors and authenticated MACs via Laravel's Crypt system. Plaintext keys only exist in volatile memory during outgoing requests.

Password Hashing

User passwords are salted and hashed using Argon2id or Bcrypt with elevated work factors. We never store, log, or have access to raw user passwords.

Application Defense & OWASP Hardening

CSRF Protection: Cross-Site Request Forgery tokens are validated on all mutating HTTP requests and Livewire component dispatches.
SQL Injection Prevention: All database queries utilize Eloquent ORM and PDO parameterized statements with bound parameters. Raw SQL concatenation is strictly prohibited.
Secure Cookie Flags: Authentication cookies are minted with HttpOnly (blocking JavaScript XSS inspection), SameSite=Lax, and Secure flags.
Input Sanitization: Journal HTML content and rich text entries are sanitized to neutralize malicious script injection.

Zero Plaintext Logging Policy

Lumina enforces strict logging sanitization:

API keys, journal content, and authentication passwords are automatically redacted from error traces and production loggers.
Temporary ephemeral chat sessions are processed in memory and never written to cold log storage.
Outgoing API requests to Google Gemini and ElevenLabs are hardened with strict timeouts to prevent hung requests from leaving unmanaged traces.

Responsible Disclosure Policy

We welcome responsible security research. If you believe you have discovered a potential vulnerability in Lumina, please report it immediately:

Security Inquiries: security@lumina-journal.com

GitHub Security Advisory

Explore other legal documentation: