SOC2 ALIGNED SECURITY

Security Policy & Vulnerability Program

Effective Date: August 25, 2026  |  Version: 2.1.0  |  Security Desk: security@sluxia.com

At Sluxia Inc., platform security is fundamental to our architecture. The Ohu Web Intelligence Platform processes high-volume web requests, vector RAG context, and AI datasets. This Security Policy documents our cryptographic standards, infrastructure controls, and Responsible Vulnerability Disclosure Program.

1. Cryptographic Standards & Secret Key Custody

• Transport Encryption: 100% of network traffic to and from Ohu endpoints is encrypted in transit using mandatory TLS 1.3 / TLS 1.2 with modern cipher suites. Plain HTTP traffic is automatically upgraded to HTTPS.
• API Key Cryptographic Hashing: Raw secret API keys (`ohu_live_...`) are generated via secure random UUIDs and displayed to the user once upon creation. In our database, keys are stored strictly as 256-bit SHA-256 one-way cryptographic hashes. We cannot read or recover raw API keys.
• Password Hashing: User account passwords are hashed using 12-round bcrypt salt iterations, rendering raw credentials immune to rainbow table attacks.

2. Infrastructure & Network Defense

• Edge WAF & DDoS Protection: All requests pass through Cloudflare Edge Web Application Firewall (WAF) nodes, providing real-time mitigation against Layer 7 DDoS attacks, SQL injection, and automated bot networks.
• Brute-Force Rate Limiting: Authentication routes (`/ohu/api/v1/auth/*`) enforce automatic 5-attempt brute-force lockouts to prevent credential stuffing.
• Process Sandboxing & Memory Safety: Backend Node.js processes run in isolated containerized Passenger environments with memory limits (<120MB RSS threshold per process) and automatic process recycling.

3. Transient In-Memory Scraping Security

Zero Target Content Storage: Web pages, PDFs, and DOM payloads fetched during crawling or distillation are processed strictly in volatile RAM memory. Target content is never written to disk, stored in databases, or logged in persistent files. Once the HTTP response payload is transmitted to your application, the memory buffer is zeroed out.

4. Native Prompt Injection Defense Engine (`ohu_security_audit`)

Ohu includes a built-in security auditing tool (`POST /ohu/api/v1/security-audit`) designed to protect AI agents against web-based Indirect Prompt Injection attacks:

• NFKC Unicode Normalization: Normalizes fullwidth characters, homoglyphs, and zero-width spaces prior to inspection.
• DOM Concealment Inspection: Scans target DOM elements for invisible text (`display:none`, `visibility:hidden`, `opacity:0`), offscreen coordinate positioning (`left: -9999px`), zero-font text, and hidden HTML comments targeting AI crawlers.
• Shannon Entropy Analysis: Calculates character entropy (threshold $\ge 3.5$ bits) to detect obfuscated payloads and high-entropy secret leaks.
• Secret Corpus Detection: Scans target content for 14 credential regex families (AWS secret keys, Stripe live keys, GitHub tokens, JWTs, private RSA keys).

5. Responsible Vulnerability Disclosure Program

We welcome security researchers and ethical hackers to inspect our services and report potential security vulnerabilities under our Responsible Disclosure Program.

Program Scope

• Web Application: `https://sluxia.com/ohu`
• REST API Services: `https://sluxia.com/ohu/api/v1/*`
• Remote MCP Server: `https://sluxia.com/ohu/mcp`

Researcher Guidelines & Safe Harbor

• No Data Destruction: Do not modify, destroy, or access data belonging to other accounts. Use your own developer account for testing.
• No Denial of Service: Do not perform volume-based Denial of Service (DDoS) testing against our infrastructure.
• Prompt Reporting: Submit vulnerability reports immediately to security@sluxia.com including detailed reproduction steps.
• Safe Harbor Guarantee: If you conduct vulnerability research in good faith and comply with these guidelines, Sluxia will not initiate legal action or law enforcement complaints against you.