MetaPilot handles sensitive WhatsApp API access tokens, JWT tokens, tenant data, and encrypted secrets. We take security seriously and appreciate responsible disclosure.
If you discover a security vulnerability within MetaPilot, please do NOT open a public issue. Instead, report it privately via email:
- Security Email: security@metapilot.in
- Response Time: We aim to acknowledge reports within 24 hours and provide a patch timeline within 72 hours.
Please include:
- Description of the vulnerability and potential impact.
- Step-by-step instructions or proof-of-concept to reproduce.
- Any suggested mitigations or fixes.
MetaPilot enforces security-in-depth across all system layers:
- Tenant Secrets: Access tokens, Meta App secrets, and API credentials are encrypted at rest using Fernet (AES-256 in CBC mode with HMAC authentication) via
cryptography. - Key Storage: The
FERNET_KEYis injected exclusively via environment variables and is never stored in code, logs, or databases.
- JWT Authentication: User sessions are authenticated using Short-lived JWT Access Tokens and Long-lived Refresh Tokens (
rest_framework_simplejwt). - Role Hierarchy: Strict role scoping (
SUPER_ADMIN,AGENCY_ADMIN,TENANT_ADMIN,TENANT_USER). - Tenant Isolation: Every database query is scoped by
TenantMiddlewareusing strict header/URL-based tenant isolation.
- HMAC Verification: All incoming Meta Graph API webhooks require SHA-256 HMAC signature verification (
X-Hub-Signature-256) against the tenant's app secret. - Replay Protection: Webhook payloads are timestamp-validated.
- Automatic static code analysis and dependency vulnerability scans are run on every pull request.
- Python packages are locked and audited; Node/Next.js dependencies are checked against known CVEs.