Security at ExamDump Pro
Security is designed in, not bolted on.
Server-enforced limits
Free and premium entitlements are enforced on the API, never in the browser. Questions cannot be enumerated beyond your plan.
Private dataset
Question banks live in a private GitHub repository and are proxied through the API using a short-lived server-side token.
Secrets management
All credentials are injected at runtime by Doppler. Nothing sensitive is committed to version control.
Secure sessions
Short-lived JWT access tokens plus rotating, hashed refresh tokens stored in HttpOnly cookies.
Hardening
Helmet security headers, strict CORS, request validation, rate limiting, audit logging and per-user quotas.
Data isolation
Application data lives in a dedicated MongoDB database with least-privilege credentials.
To report a vulnerability, contact the maintainers privately. Please do not open a public issue for security reports.