Security

Yoyaku uses HTTPS, Caddy security headers, CORS controls, body-size limits, rate limits for sensitive routes, authentication, tenant separation, and role permissions.

Payment-provider secrets are encrypted with AES-256-GCM using an environment key. Photos and attachments use S3 with separate permissions for public and private content.

Production infrastructure is designed around EC2, RDS PostgreSQL, S3, local Redis for jobs, and GitHub Actions for deployment. RDS should not be publicly exposed and should only accept connections from the application server.

Report security issues to [email protected]. Include reproduction steps, possible impact, and useful evidence.