Security

Passwords are stored using PBKDF2 with SHA-256, a per-password random salt, and 60,000 iterations. Email verification codes are stored as hashes, expire after 10 minutes, and are limited to five incorrect attempts. Password reset values are stored as hashes and expire after 30 minutes.

Sessions are stored server-side and expire after 30 days. The session cookie is HttpOnly and SameSite=Lax, and is configured Secure in production.

Application code applies role and ownership checks to protected account, land, and administrative operations. Newsletter confirmation and unsubscribe tokens are stored as hashes; unsubscribe tokens retained for server-side delivery are encrypted by the application using AES-256-GCM and a configured secret.

These are application-level controls. We do not claim that all stored data is encrypted at rest or in transit by this application, or that the service has a security certification or independent audit.

Email must be verified before a user can sign in. Server routes check the stored session and enforce roles and land ownership for protected operations. Administrative newsletter and news actions require an authenticated administrator.

The service uses MongoDB for application records and Resend for email delivery. Database connection credentials and email-provider credentials are configured as server environment variables. Production session cookies use the Secure attribute. Infrastructure configuration and provider-level controls are outside the application code and may vary by deployment; no specific provider certification is represented here.

If you believe you have found a security vulnerability, email soilcreditazerbaijan@gmail.com with a clear description and steps to reproduce it. Do not include real users’ personal data, access data you do not own, or disrupt the service. Please allow us reasonable time to investigate before publicly disclosing a report.

We review reports and suspected incidents, take reasonable steps to investigate and limit impact, and determine whether affected users or authorities must be notified under applicable requirements. The application does not publish a guaranteed response time or incident-response certification.

Security reports and questions: soilcreditazerbaijan@gmail.com.