Security

All traffic uses HTTPS with certificates from Let's Encrypt. Plain HTTP is redirected, and browsers are told to use HTTPS only (HSTS). Data at rest sits on Google Cloud disks, which Google encrypts by default.

Passwords are hashed with argon2id and are never stored or logged in plain text. Login tokens are kept in HttpOnly, Secure, SameSite cookies that page scripts cannot read. Access tokens expire after 15 minutes. Refresh tokens last 30 days and are stored only as hashes. Sign-in and other endpoints are rate-limited.

NewsIQ runs on Google Cloud in Singapore. The database, cache and search services are reachable only inside the server's private network, not from the internet. The only public entry points are the website, the API and the admin dashboard, all over HTTPS. Server access uses SSH keys only, and administrative features require an administrator account.

Every change runs automated tests and security scans: static analysis (CodeQL), container vulnerability scanning (Trivy), a Python dependency audit, and secret scanning. Errors are monitored in production.

NewsIQ is operated by one person. There is not yet two-factor authentication for user accounts, no formal certification such as ISO 27001 or SOC 2, and no bug bounty. We would rather say so than overstate it.

Email hello.newsiq@gmail.com with "Security" in the subject, and describe the issue and how to reproduce it. Please act in good faith: do not access other people's data, disrupt the service or publish details before we have fixed it. We acknowledge reports within 72 hours and will keep you updated. Our security.txt is at https://newsiq.online/.well-known/security.txt.

If a security incident affects personal data, we will contain it, notify affected users, and report it to CERT-In and the Data Protection Board of India as the law requires.