Your data, your control.
SCALA MDO is built to OWASP 2023 standards. Every feature audited, every secret encrypted, every event logged.
Security architecture
AES-256-GCM token encryption
Etsy OAuth access + refresh tokens stored encrypted at rest with AES-256-GCM. Rotating the key invalidates tokens automatically.
PBKDF2-SHA256 600k iter
Passwords hashed via PBKDF2-SHA256 with per-user salt (OWASP 2023 standard). Older hashes are silently upgraded on the next login.
2FA (TOTP) + recovery codes
Optional RFC 6238 TOTP. When enabled login requires a TOTP code or a one-time recovery code. Compatible with Google/Microsoft Authenticator.
IP whitelist (optional)
Add known IPs (home, office) to the whitelist. When active, login from other IPs is blocked and the violation is audit-logged.
Brute-force protection
Account locks temporarily after 5 failed attempts. 2FA failures also trigger the counter — blocks TOTP guessing.
Audit log
Login, logout, 2FA enable/disable, password change, session revoke, IP whitelist edits, GDPR export — all logged. CSV exportable.
GDPR data export
Download all your data as a ZIP with one click. Profile, listings, audit log, settings — everything. Take it to another tool.
Account deletion
Account deletion re-prompts for the password, then erases all data (tokens included) immediately. No recovery.
Anomaly detection
Unusual login location, traffic spikes, new device — the user is notified by email.
Automatic backups
Profile + settings + listing history backed up daily. Restore to any backup (path-traversal protected).
HMAC timing-safe
Session token verification uses `crypto.timingSafeEqual` — resistant to timing-oracle attacks.
CSP + HSTS + sameSite=lax
Restricted Content-Security-Policy script-src, HSTS preload, session cookie sameSite=lax (CSRF defense).
Threat model
- Credential stuffing — brute-force lockout + 2FA
- Token theft — AES-256-GCM at-rest + timing-safe verify
- Path traversal — strict ID regex + path containment
- CSRF — sameSite=lax cookie + token-bound HMAC
- XSS — CSP + sanitization on user-authored HTML
- Cost amplification — per-user rate limit on AI endpoints
Vulnerability disclosure
Discovered a security issue? Please don't open a public bug report. Contact us directly:
Response: initial acknowledgement within 48 hours, action plan within 7 days. Valid findings are thanked on the "Hall of Thanks" page (optional).
Want to see the details?
The full security architecture is openly documented in our GitHub repository.