Security at NodeBreach
We take security seriously. Here's how we protect your data and ensure safe learning environments.
Isolated Containers
Every vulnerable training node runs in its own isolated Docker container. These containers have no network access to other users' systems or our infrastructure. You can practice exploitation techniques safely without risk to real systems.
Encryption
All data in transit is encrypted using TLS 1.3. Sensitive data at rest is encrypted using AES-256. Passwords are hashed using bcrypt with appropriate cost factors.
Authentication
We support two-factor authentication (2FA) using TOTP. Enterprise users can integrate with their existing SSO providers (Google, Microsoft, GitHub). Session management includes automatic timeout and concurrent session controls.
Access Control
Role-based access control (RBAC) ensures users only access resources they're authorized for. API endpoints are protected with token-based authentication. All access is logged and auditable.
Data Protection
We're GDPR compliant. You can export or delete your data at any time from your profile settings. We retain minimal data necessary for service operation and never sell your information to third parties.
Responsible Disclosure
We appreciate security researchers who help us keep NodeBreach secure. If you discover a vulnerability, please report it responsibly.
How to Report
- Email your findings to security@nodebreach.com
- Include detailed steps to reproduce the vulnerability
- Provide any proof-of-concept code if applicable
- Allow us reasonable time to address the issue before public disclosure
What We Ask
- Don't access other users' data or disrupt service availability
- Don't publicly disclose until we've had time to fix the issue
- Act in good faith to avoid privacy violations and data destruction
Compliance & Certifications
GDPR
Compliant with EU data protection regulations
SOC 2
Type II certification in progress
TLS 1.3
A+ rating on SSL Labs
Questions About Security?
Our security team is happy to answer any questions about our practices.
Contact Security Team