QLYNK ACCOUNT · INFORMATION

Security at QLYNK

A plain-language overview of the sign-in protections currently implemented and the controls still planned.

This is a draft information page for the static preview, not a final legal document.

Provider sign-in

Google, Discord and GitHub sign-in use server-side authorization-code exchange. The start request validates the provider allowlist, Turnstile result and configured callback path. The callback compares the returned state with a short-lived, HttpOnly transaction cookie before exchanging the code. PKCE is used for Google and GitHub; Discord uses its documented confidential-client authorization-code flow plus state validation.

Session handling

Successful authentication creates a random session token in a Secure, HttpOnly, SameSite=Lax, host-only cookie. QLYNK stores only a SHA-256 hash of that token, checks session expiry on each session lookup, and removes the session on logout. Provider access tokens are not stored as account credentials.

Database and personal data

MongoDB holds account, provider-identity and session records. The latest successful sign-in context stores the Cloudflare-provided IP when available, user-agent, allowlisted non-secret headers, country and optional IP-network signals. Raw Cookie and Authorization headers are not intentionally stored.

Bot and abuse prevention

Turnstile tokens are validated server-side against the expected hostname and action; known command-line or common automation user-agent patterns are blocked. IPinfo's VPN/proxy/hosting data is only an enrichment signal and depends on the subscription tier. These signals cannot identify every bot. Before wider launch, configure and test request rate limits and alerting in Cloudflare.

Limitations

Email/password authentication, email verification, MFA/passkeys, account linking, account deletion, self-service session management, the full product authorization dashboard, and automated backups are not implemented yet. The current implementation should be tested against the production OAuth provider settings and Cloudflare environment before being treated as fully production-ready.

Report a concern

A dedicated security contact has not yet been published. Before inviting a wider audience, publish a monitored contact address and a process for reporting vulnerabilities without sharing passwords, tokens or other secrets.