Security Policy

Mixed Race Community (MRC) handles sensitive personal data, including racial and ethnic heritage information that is classified as special category data under GDPR. We take the security of this data extremely seriously and implement layered security controls to protect it.

This page describes our security practices, what we protect, and how security researchers and members of the public can responsibly disclose vulnerabilities to us.

Special category data: Heritage and ethnicity information you provide is classified as special category data under GDPR Article 9. We apply heightened protections to this data, including strict access controls and encryption at rest and in transit.

Account credentials: Passwords are hashed using bcrypt with appropriate cost factors before storage. We never store plaintext passwords.

Session data: Authentication sessions are managed using httpOnly, secure cookies that are not accessible to JavaScript. Sessions expire after 30 days of inactivity.

Profile and content data: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). Data at rest is stored on encrypted infrastructure provided by Vercel and Supabase.

Encryption in transit: All traffic to and from mixedracecommunity.com is served over HTTPS with TLS. HTTP requests are redirected to HTTPS.

Encryption at rest: Database and file storage are encrypted at rest by our infrastructure providers (Supabase and Vercel Blob).

CSRF protection: All state-changing requests are protected against cross-site request forgery using the mrc_csrf token.

Rate limiting: Sign-in, sign-up, and sensitive API endpoints are rate-limited to prevent brute-force attacks.

Bot protection: Cloudflare Turnstile is used on authentication and registration forms to prevent automated abuse.

Session management: Sessions are invalidated on sign-out and on password change. We do not extend sessions silently beyond the stated 30-day window.

Access controls: Our team operates on the principle of least privilege. Only personnel who need access to production data to perform their role have it.

Dependency management: We monitor our dependencies for known vulnerabilities and apply patches promptly.

We welcome reports from security researchers and members of the public who discover potential vulnerabilities in our platform. Please report any security issues to us before disclosing them publicly so we have the opportunity to investigate and remediate.

To report a vulnerability, email security@mixedracecommunity.com with: a clear description of the vulnerability and potential impact, steps to reproduce the issue (proof-of-concept code, screenshots, or videos are helpful), the URL or endpoint affected, and your contact information if you would like updates on our progress.

We ask that you do not access, modify, or delete data belonging to other users while investigating, and that you do not perform denial-of-service attacks or social engineering against our team or users.

We are interested in reports of: SQL injection, cross-site scripting (XSS), CSRF bypass, authentication or authorisation flaws, session management weaknesses, data exposure (especially special category data), server-side request forgery (SSRF), insecure direct object references, and other vulnerabilities with meaningful security impact.

We are generally not interested in reports of: rate-limiting on low-risk endpoints, missing security headers with no exploitable impact, theoretical vulnerabilities without a working proof of concept, or issues only reproducible on outdated or unsupported browsers.

Acknowledgement: We will acknowledge receipt of your report within 48 hours.

Triage: We will assess severity and reproduce the issue within 7 days where possible.

Resolution: We aim to resolve critical vulnerabilities within 14 days and all other valid reports within 90 days. We will keep you informed of our progress.

Disclosure: We will coordinate with you on the timing of any public disclosure once a fix is in place.

Mixed Race Community will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, who do not access or alter data beyond what is necessary to demonstrate the vulnerability, who do not disclose the vulnerability publicly before we have had a reasonable opportunity to fix it, and who do not use the vulnerability for personal gain or to harm our users.

We consider responsible security research a valuable contribution to the safety of our community. Researchers acting in good faith will be treated as partners, not adversaries.