Product: InterviewPilot AI Document: Security Guidelines Version: 1.0 Status: Draft Owner: Niranjan Sah

This document defines the security requirements and guidelines for InterviewPilot AI.

• Passwords hashed using bcrypt
• Salt rounds: minimum 12
• Never store plaintext passwords

• Access token expiry: 15 minutes
• Refresh token expiry: 7 days
• Tokens signed with HS256 (or RS256 for future)
• Refresh tokens stored server-side

• Access tokens in memory (not localStorage)
• Refresh tokens in HttpOnly cookies
• CSRF protection via double-submit cookie

Users can only access their own:

• Interview sessions
• Transcripts
• Feedback reports

All /api/* routes except /auth/* require authentication.

• Form validation before submission
• Type checking with TypeScript

• Pydantic models for all inputs
• Strict type enforcement
• SQL injection prevention via ORM
• XSS prevention via output encoding

• 100 requests per minute per user
• Stricter limits on auth endpoints

• Configured for known origins only
• No wildcard in production

• Security headers via Helmet middleware

• API keys in environment variables
• No secrets in code or config files
• Credentials excluded from logs

• SSL connections required
• Principle of least privilege
• Regular backups

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'

• Regular npm audit / pip audit
• Keep dependencies updated
• Pin critical dependencies

• 05-API.md
• 02-TECHSTACK.md