Security — LabsNinja SCIM Connector

Authentication & Credentials

🔒 PBKDF2-SHA256 Token Hashing

SCIM bearer tokens are hashed with PBKDF2-SHA256 before storage. Plaintext credentials are never persisted to disk or logs.

🔄 Token Rotation

Credentials can be rotated at any time via the operator dashboard. Old tokens are invalidated immediately on rotation.

👤 Operator Session Auth

Operator and customer sessions use signed session tokens with configurable expiry and revocation support.

🚫 Fail-Fast on Misconfiguration

The application validates all required environment variables at startup and refuses to start if any are missing.

Tenant Isolation

🏢 Credential Isolation

SCIM credentials are tenant-scoped. A token issued for tenant A cannot access or modify tenant B data.

🚫 Operator / Customer Separation

Internal operator routes and customer-facing routes are on separate auth stacks with different session types and privilege levels.

Security Checklist

Control	Status
TLS enforced on all external traffic	✓ Enforced by Caddy
Application network exposure restricted	✓ Private application binding enforced
Bearer tokens PBKDF2-SHA256-hashed	✓ Never stored plaintext
Tenant data isolation in all queries	✓ Row-level scoping
Operator / customer auth stacks separated	✓ Separate session types
Secrets validated at startup	✓ Fail-fast on missing config
Audit log on all privileged actions	✓ Structured JSON audit log
Input validation on all SCIM endpoints	✓ Pydantic schema validation

Planned, not yet implemented

The items below are intentionally listed as work in progress. We will only mark them as in place once they are implemented and validated.

Automated, tested database backups with documented restore drills.
Formal incident response runbook with named on-call rotation and post-incident review template.
Independent security review of the SCIM endpoint surface.
Bug bounty / coordinated disclosure program.

What we do not claim

We do not claim SOC 2, ISO 27001, or any other certification at this time. We do not claim full GDPR compliance or guaranteed uptime. Our published Privacy Policy and DPA are designed with GDPR principles in mind and are subject to legal review before general availability.

Security contact

To report a suspected vulnerability or security incident, email security@labsninja.com. Please do not disclose details publicly until we have had a reasonable opportunity to investigate and respond.

Questions about our security posture?

Security Inquiry

Security is First-Class