PAC is built with privacy-first and security-by-design principles:

1. No Location Database

   • ✅ PAC does NOT store any addresses or locations
   • ✅ All encoding/decoding happens algorithmically
   • ✅ No persistent storage of geographic data

2. No User Registration

   • ✅ No user accounts required
   • ✅ No personal information collected
   • ✅ No tracking or profiling

3. No Logging of Sensitive Data

   • ✅ PAC codes are NOT logged
   • ✅ Coordinates are NOT logged
   • ✅ Request payloads are NOT logged
   • ⚠️ Only metadata is logged (timestamps, IPs for rate limiting, endpoints)

4. Client-Side First

   • ✅ SDK works 100% offline
   • ✅ No server required for basic operations
   • ✅ API is optional (for convenience only)

All API endpoints (except health checks) require authentication:

X-API-Key: {payload}.{signature}

API keys are HMAC-based tokens that:

• Do NOT contain sensitive data
• Can be revoked instantly
• Are rate-limited per key
• Have configurable scopes/permissions

Rate limiting prevents:

• Denial of Service (DoS) attacks
• Brute force attacks
• Resource exhaustion
• Abuse

The API implements adaptive anti-bot challenges:

• Triggered when suspicious patterns detected
• CAPTCHA/Turnstile integration
• IP reputation checking
• Request pattern analysis

Note: Anti-bot is best deployed at Edge/WAF layer (Cloudflare, AWS WAF, etc.)

CORS is configured with a whitelist of allowed origins:

{
  "AllowedOrigins": [
    "https://yourdomain.com",
    "https://app.yourdomain.com"
  ]
}

Development: localhost origins are allowed in development mode only.

In production:

• ✅ All connections MUST use HTTPS
• ✅ HTTP requests are rejected
• ✅ HSTS headers are set
• ✅ TLS 1.2+ required

API Keys Table (minimal):

CREATE TABLE ApiKeys (
    Id UUID PRIMARY KEY,
    KeyHash VARCHAR(64) NOT NULL,  -- SHA-256 hash
    CreatedAt TIMESTAMP NOT NULL,
    ExpiresAt TIMESTAMP,
    IsRevoked BOOLEAN DEFAULT FALSE,
    Scopes JSONB  -- Optional permissions
);

Nothing Else: No addresses, no locations, no coordinates, no PAC codes.

Allowed Logs:

{
  "timestamp": "2026-01-21T12:00:00Z",
  "ip": "192.168.1.1",
  "endpoint": "/v1/pac/encode",
  "statusCode": 200,
  "duration": 15,
  "apiKeyId": "uuid"
}

Forbidden Logs:

{
  "pacCode": "NEVER LOGGED",
  "latitude": "NEVER LOGGED",
  "longitude": "NEVER LOGGED",
  "payload": "NEVER LOGGED"
}

• Access Logs: 7 days (for debugging)
• Error Logs: 30 days (for monitoring)
• Audit Logs: 90 days (for security)
• API Key Logs: Indefinite (for billing/compliance)

1. Location Tracking

   • ❌ No database = no tracking possible
   • ❌ No logs = no history reconstruction

2. Data Breaches

   • ❌ No sensitive data to breach
   • ✅ API keys can be revoked instantly

3. Man-in-the-Middle (MITM)

   • ✅ HTTPS enforced
   • ✅ Certificate pinning recommended for mobile apps

4. Denial of Service (DoS)

   • ✅ Rate limiting per IP
   • ✅ Rate limiting per API key
   • ✅ Adaptive anti-bot

5. Brute Force

   • ✅ Rate limiting prevents enumeration
   • ✅ No user accounts to brute force

1. Client-Side Attacks

   • ⚠️ XSS/CSRF protection is app developer's responsibility
   • ⚠️ Secure storage of API keys is app developer's responsibility

2. Network-Level Attacks

   • ⚠️ DDoS mitigation should be handled by CDN/WAF
   • ⚠️ BGP hijacking is outside our control

3. Physical Security

   • ⚠️ Device theft/loss is user's responsibility
   • ⚠️ Shoulder surfing is user's responsibility

If you discover a security vulnerability, please:

1. DO NOT open a public GitHub issue

2. Email: [Email]moahmedyousif28@gmail.com) • 🐦 Follow on LinkedIn

3. Include:

   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• 24 hours: Initial acknowledgment
• 7 days: Assessment and triage
• 30 days: Fix and disclosure (coordinated)

We currently do NOT have a bug bounty program, but we:

• Acknowledge security researchers in our SECURITY.md
• Provide swag/merchandise for valid reports
• May offer monetary rewards for critical vulnerabilities

// ✅ Good: Client-side SDK (no network, no logs)
import { encode } from '@pac/core';
const pac = encode({ latitude, longitude });

// ❌ Avoid: API call (network, logs, rate limits)
const response = await fetch('/v1/pac/encode', { ... });

// ✅ Good
logger.LogInformation("PAC encoded successfully");

// ❌ BAD
logger.LogInformation($"PAC code: {pacCode}");

// ✅ Good: Environment variable
const apiKey = process.env.PAC_API_KEY;

// ❌ BAD: Hardcoded
const apiKey = "abc123.def456";

// ✅ Good
if (latitude < -90 || latitude > 90)
    throw new ArgumentOutOfRangeException();

// ❌ BAD: No validation
var pac = PACCore.Encode(latitude, longitude);

// ✅ Good
try {
  const result = decode(pacCode);
  if (!result.isValid) {
    console.error("Invalid PAC code");
    return;
  }
} catch (error) {
  console.error("Decode failed:", error.message);
}

// ❌ BAD: Expose internals
catch (error) {
  alert(error.stack); // Leaks implementation details
}

PAC is GDPR-friendly because:

• ✅ No personal data collected
• ✅ No user profiling
• ✅ No cross-site tracking
• ✅ No data retention (except API keys)

PAC is CCPA-friendly because:

• ✅ No sale of personal information
• ✅ No sharing with third parties
• ✅ No targeted advertising

PAC does NOT handle:

• ❌ Health information (HIPAA)
• ❌ Payment information (PCI-DSS)

Therefore, these regulations do not apply.

• Frequency: Quarterly
• Scope: Code review, dependency scan, penetration testing
• Tools: SonarQube, OWASP ZAP, Snyk

• Frequency: Annually (or before major releases)
• Scope: Full security assessment
• Auditor: Independent third-party

• Automated: Dependabot/Renovate for dependency updates
• Review: All security updates reviewed within 24 hours
• Deployment: Critical patches deployed within 48 hours

We monitor:

• .NET CVEs
• Node.js/npm CVEs
• Docker base image CVEs
• Third-party library CVEs

Subscribe to security advisories:

• GitHub Security Advisories
• Email: moahmedyousif28@gmail.com

[Email]moahmedyousif28@gmail.com) • 🐦 Follow on LinkedIn

Last Updated: 2026-01-21
Version: 1.0