This guide covers security best practices and features for Markdown Cloud Vault.

Cloud Vault provides multiple security features:

• Authentication: Secure user login and session management
• Authorization: Role-based access control
• Encryption: Data protection in transit and at rest
• Rate limiting: Protection against brute force attacks
• Input validation: Protection against injection attacks

Configure password requirements:

[auth.password]
min_length = 12
require_uppercase = true
require_lowercase = true
require_numbers = true
require_special = true

[auth]
session_ttl = 86400  # 24 hours
cookie_secure = true  # HTTPS only
cookie_httponly = true  # No JavaScript access
cookie_samesite = "strict"  # CSRF protection

Protect against brute force:

[auth.rate_limit]
enabled = true
max_attempts = 5
window_seconds = 300  # 5 minutes
lockout_seconds = 900  # 15 minutes

Enable 2FA for all users:

[auth]
two_factor_enabled = true
two_factor_required = true

Enable HTTPS in production:

[server]
tls_enabled = true
tls_cert_file = "/path/to/cert.pem"
tls_key_file = "/path/to/key.pem"
tls_min_version = "1.2"

# Allow only necessary ports
sudo ufw allow 443/tcp  # HTTPS
sudo ufw allow 22/tcp   # SSH
sudo ufw enable

Use reverse proxy for additional security:

# Nginx configuration
server {
    listen 443 ssl http2;
    
    # SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Encrypt sensitive data:

[security]
encryption_enabled = true
encryption_key = "${ENCRYPTION_KEY}"

Generate encryption key:

openssl rand -hex 32

Encrypt backup archives before storing them offsite:

gpg -c backups/cloud-vault-backup-20260603-120000.zip

[database]
# Use dedicated database user
username = "cloud_vault"
password = "${DB_PASSWORD}"

# Restrict file permissions
file_mode = "0600"

[cors]
enabled = true
allowed_origins = ["https://vault.yourdomain.com"]
allowed_methods = ["GET", "POST", "PUT", "DELETE"]
allow_credentials = true

[rate_limit]
enabled = true
requests_per_minute = 60
burst = 10

# Store API keys in environment variables
export OPENAI_API_KEY="sk-..."
export QINIU_ACCESS_KEY="..."
export QINIU_SECRET_KEY="..."

# Never commit keys to version control
echo "*.key" >> .gitignore
echo ".env" >> .gitignore

[import]
max_file_size = 10485760  # 10 MB
allowed_extensions = [".md", ".markdown", ".txt"]
scan_malware = true

Cloud Vault uses parameterized queries:

// Safe: parameterized query
stmt, _ := db.Prepare("SELECT * FROM documents WHERE id = ?")
rows, _ := stmt.Query(docID)

// Unsafe: string concatenation (never do this)
// query := "SELECT * FROM documents WHERE id = " + docID

[security]
sanitize_html = true
escape_output = true
content_security_policy = "default-src 'self'"

Configure security headers:

[security.headers]
strict_transport_security = "max-age=31536000; includeSubDomains"
x_frame_options = "SAMEORIGIN"
x_content_type_options = "nosniff"
x_xss_protection = "1; mode=block"
referrer_policy = "strict-origin-when-cross-origin"
content_security_policy = "default-src 'self'; script-src 'self' 'unsafe-inline'"

[logging]
level = "info"
audit_enabled = true
audit_events = ["login", "logout", "permission_denied", "config_change"]

# Monitor failed logins
./cloud-vault logs tail | grep "login failed"

# Check for brute force attempts
./cloud-vault logs tail | grep "rate limit exceeded"

[logging]
access_log_enabled = true
access_log_format = "combined"

# Check for updates
./cloud-vault update check

# Apply updates
./cloud-vault update apply

# Update Go dependencies
go get -u ./...

# Update system packages
sudo apt update && sudo apt upgrade

# Scan for vulnerabilities
gosec ./...

# Check dependencies
govulncheck ./...

• Enable HTTPS
• Configure firewall
• Set strong passwords
• Enable 2FA
• Configure rate limiting
• Set up backups
• Enable logging
• Review CORS settings
• Configure security headers
• Test authentication

• Use dedicated database user
• Encrypt sensitive data
• Enable backup encryption
• Monitor security logs
• Set up alerts
• Regular security audits
• Keep software updated
• Review access logs
• Test disaster recovery

If you suspect a security breach:

1. Isolate affected systems:

sudo systemctl stop cloud-vault

2. Preserve evidence:

tar -czf incident-$(date +%Y%m%d-%H%M%S).tar.gz \
  /var/log/cloud-vault/ \
  /var/lib/cloud-vault/

3. Reset credentials:

./cloud-vault user reset-password --username admin
./cloud-vault auth invalidate-all-sessions

4. Review logs:

./cloud-vault logs view /var/log/cloud-vault/app.log | grep -E "(ERROR|WARN)"

5. Restore from backup:

./cloud-vault restore --file clean-backup.zip --data-dir /var/lib/cloud-vault/data

6. Notify users (if data compromised)

• Data minimization: Collect only necessary data
• Right to erasure: Delete user data on request
• Data portability: Export data in standard formats
• Consent: Clear privacy policy

• Access control: Role-based permissions
• Audit logs: Track all access
• Encryption: Protect data in transit and at rest
• Monitoring: Continuous security monitoring

• OWASP Top 10
• NIST Cybersecurity Framework
• Cloud Security Alliance

• Vulnerability scanning: gosec, govulncheck
• Penetration testing: OWASP ZAP, Burp Suite
• Log analysis: ELK Stack, Splunk
• Monitoring: Prometheus, Grafana

• Authentication - Authentication features
• Privacy - Privacy considerations
• Diagnostics - Security diagnostics

Last updated: 2026-05-30