Tenka.cloud hardens the platform for you. These are the controls it already runs — and the ones your app still owns.
Handled by Tenka.cloud ACTIVE
✓TLS / HTTPS everywhere
nginx + Let's Encrypt terminate SSL and auto-renew certs. Plain HTTP is redirected to HTTPS.
✓Security headers preset
HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy are set at the edge on every response.
✓Reverse proxy isolation
nginx fronts the app on 80/443 and proxies only to localhost:3000, so the Node process is never exposed directly.
✓IP-authenticated mail relay
Transactional email & magic-links go through an allowlisted relay — no SMTP creds live in your app.
✓Metered, managed AI keys
Claude & Mistral keys are injected from the environment and billed to the VM — never committed to code.
Your app still owns DO THIS
→Validate every input
Treat all external input as untrusted: guard against SQLi, XSS, SSRF and path traversal. Use parameterized queries — never string-concatenate SQL.
→Authorize server-side, fail closed
Authentication ≠ authorization. Check permissions on every action, apply least privilege, and let any error deny access — never grant it.
→Set an app-tuned CSP
The edge can't know your resources. This page ships its own Content-Security-Policy scoped to same-origin assets only.
→Beat slopsquatting
Verify every dependency is real before installing, pin versions, commit the lockfile. Never curl … | sh from an unverified source.
→Guard your secrets
Load keys, tokens & passwords from the environment. Never hard-code, commit, or log them.
→Compartmentalise the code
Keep auth/session/credential code in app/auth/ and features in app/core/ so security review stays contained.
→Avoid insecure defaults
No debug mode in prod, no wildcard CORS, no default credentials, no verbose error leaks to clients.