# TronVibes Security and DDoS Plan

This page is a practical launch checklist. It is not a promise that risk is gone. It is the current protection plan for the website, API, free games, wallet profiles, and AI support and reflection tools.

## Current Controls

- React app ships without Stripe secret keys, B.AI keys, wallet encryption keys, or private keys.
- Server API keeps B.AI and Stripe calls server-side.
- Express rate limits protect the full `/api` surface, plus tighter AI, Stripe, auth, wallet export, and legacy Joy claim endpoints.
- Auth sessions use HttpOnly cookies with SameSite controls and HTTPS-aware Secure cookie behavior.
- State-changing API requests are checked against the configured allowed origins before processing.
- Static `public_html` uploads include Apache `.htaccess` hardening for directory listing, security headers, basic secret path blocking, and SPA routing.
- Profile wallet private keys are encrypted at rest with `WALLET_ENCRYPTION_KEY`.
- Trace Memory is opt-in and stores compressed relationship context, not secrets. The public architecture note is `/trace-memory.md`.
- Trace notes pass through a redaction layer before storage and are capped by `TRACE_EPISODE_LIMIT`.
- Wallet, name/date, word, and number reflections are free at launch. The API protects them with rate limits, origin checks, and server-side B.AI keys.
- Free public AI reflections can also require Google reCAPTCHA v3 when `RECAPTCHA_SECRET_KEY` and `VITE_RECAPTCHA_SITE_KEY` are configured.
- reCAPTCHA verification checks expected action, hostname, score thresholds, and a stricter low-score throttle before B.AI generation.
- A private `RECAPTCHA_BYPASS_TOKEN` can be configured for trusted smoke-test automation only. It is not exposed to browsers.
- Games are free at launch. Any future entitlement system should remain explicit, optional, and separately documented.
- Static Joy Lab pages include a lightweight browser gate for public HTML hosting.
- Silent Access hand signals and expression cues run in the browser and should not upload camera frames, biometric templates, or emotion profiles.
- Silent Access gestures suggest navigation, but the user must intentionally press "Use Current Signal" before the page moves.
- `npm audit --omit=dev` currently reports zero production dependency vulnerabilities.
- Public privacy and safety guidance is published at `/privacy-safety.md`.

## Cloudflare Setup

1. Put `TronVibes.io` behind Cloudflare DNS proxy.
2. Turn on managed DDoS protection and the Web Application Firewall.
3. Add rate rules for:
   - `/api/Support-reflection`
   - `/api/decoder/*`
   - `/api/stripe/*`
   - `/api/auth/*`
   - `/api/auth/export-wallet`
   - `/api/trace-memory`
   - `/api/joy-pass/*`
   - a broad `/api` limiter using `GLOBAL_API_RATE_LIMIT_WINDOW_MS` and `GLOBAL_API_RATE_LIMIT_MAX`
4. Add bot challenges for abnormal traffic, repeated login failures, and repeated AI requests.
5. Cache static assets aggressively, but do not cache authenticated `/api` responses.
6. Keep origin access restricted where possible so attackers cannot bypass Cloudflare directly.

## Static Hosting Headers

The cPanel/public HTML bundle includes `.htaccess` rules for Apache:

- `Options -Indexes` to prevent directory browsing.
- `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy`, and `Cross-Origin-Opener-Policy`.
- A Content Security Policy that allows the current app, Stripe Checkout, TronGrid, B.AI, Google Translate, and MediaPipe CDN needs.
- Rewrite protection for accidental `.env`, `data/`, `node_modules/`, `server.js`, and package file exposure.
- SPA fallback routing to `index.html`.

After upload, check browser console and server logs. If a trusted wallet, translation, or MediaPipe provider is blocked, update the CSP narrowly rather than removing it.

## Secrets

Keep these only in the Node server environment:

- `STRIPE_SECRET_KEY`
- `BAI_API_KEY`
- `WALLET_ENCRYPTION_KEY`
- `TRONVIBES_API_TOKEN` if you enable the optional AI follow-up token guard
- `TRONGRID_API_KEY`

Never upload `.env`, `data/`, private keys, database files, or server logs into `public_html`.

## Wallet and Profile Safety

- Tell users that exported private keys give full wallet control.
- Require password confirmation and a clear acknowledgement before export.
- Never store seed phrases in Trace Memory or AI prompts.
- Encourage users to move meaningful funds to a wallet they personally control.
- Keep generated wallets for convenience, not as a substitute for user-owned custody.

## Joy Lab Entitlement

The static gate is good enough for a simple cPanel launch. For heavier traffic, add:

- Signed game sessions issued by the Node API.
- Durable entitlement records in a real database.
- Stripe webhooks for card-based passes if card payment is added for games.
- Cloudflare rules around game asset paths if abuse appears.

## AI Safety

- Keep support free but rate-limited.
- Keep free reflection APIs rate-limited server-side, not merely controlled by frontend buttons.
- Keep AI responses framed as reflection, encouragement, Support, and practical next steps.
- Do not present numerology or symbolic readings as guaranteed facts about the future.
- Do not present hand-signal controls as full sign-language translation until validated with Deaf and sign-language users.
- Do not present expression cues as emotion diagnosis, truth detection, or spiritual judgment.
- Do not let expression cues or hand signals trigger financial actions automatically.
- Encourage users in crisis to contact local emergency services or trusted human support.

## Bot Challenge Roadmap

Free readings should stay low-friction for real users while protecting B.AI credits from automated abuse.

Implemented rollout:

1. Use Google reCAPTCHA v3 first on free AI endpoints so normal users are not interrupted by image puzzles.
2. Verify every token server-side, including hostname, expected action, and score.
3. Use score bands with the existing rate limits:
   - `0.70` and above: allow normally.
   - `0.40` to `0.69`: allow through a tighter cooldown.
   - below `0.40`: block, slow down, or require an additional challenge.
4. Keep reCAPTCHA v2 checkbox available only as a step-up challenge if suspicious traffic keeps burning API credits.
5. Continue using IP/session rate limits, origin checks, request size limits, and server-side logging because CAPTCHA is only one layer.

## Launch Rule

If a feature can move funds, reveal secrets, store identity data, or speak into someone vulnerable, it needs rate limiting, clear copy, and a graceful failure path.