shield_lockSecurity overview

How D MALL ONLINE keeps every sandbox private

A summary of the controls that protect accounts, data and the API. Report a problem to the academy team; please don’t test against other users’ accounts.

Accounts & sign-in

  • Every new account starts as pending and has no access until an administrator approves it. Admins can reject, suspend or delete accounts at any time.
  • Passwords are hashed with Argon2id, need at least 12 characters and are checked against common passwords.
  • Repeated failures lock the account temporarily; sign-in attempts are also limited per network. Error messages never reveal whether an email is registered.
  • Two-factor authentication with any authenticator app, plus single-use recovery codes. Required for administrators.

Sessions & web security

  • HttpOnly, SameSite cookies (Secure over HTTPS), fresh session IDs at sign-in, idle and absolute timeouts, and “sign out everywhere”.
  • CSRF tokens on every form and on the web app’s own API calls; same-origin checks.
  • Strict Content-Security-Policy with no inline scripts, HSTS, clickjacking protection and no content sniffing.
  • All output is escaped and all database access uses prepared statements.

Data isolation

  • Each user has a separate database file. The file is chosen from the authenticated user id only, never from anything in the request.
  • API keys and sessions both resolve to exactly one user, so one learner’s tools can never read or change another learner’s data.
  • Sandbox files and application code are outside the reach of the web server; only static assets are served directly.

API protection

  • Personal keys with read-only or read-write scope and optional expiry. Only a keyed hash is stored, and the key is shown once.
  • Per-user rate limits (with X-RateLimit-* headers) and throttling of unauthenticated or invalid-key requests.
  • Request size limits, strict JSON validation against the OpenAPI schema and generic server errors with a reference id.

Bots & abuse

  • Admin approval means automated sign-ups can never reach a sandbox.
  • Registration uses a hidden honeypot field, a minimum fill time, per-network limits and optional Cloudflare Turnstile CAPTCHA.

Monitoring

  • An audit log records sign-ins, failures, lockouts, approvals, key changes, sandbox resets and every admin action.
  • API usage is logged per user and key, so administrators can spot misuse and revoke access quickly.