Security Overview
How the DriveDiggers customer portal is protected. Last updated 3 August 2026.
Account security
Passwords are transformed with Spring Security PasswordEncoder, sessions are stored server-side, session identifiers change after login, and state-changing requests require CSRF tokens.
Access control
Customer and administrator APIs are protected by role checks. Customer recovery-case queries are scoped to the authenticated customer.
Database controls
Schema changes are managed with Flyway. The runtime database account is separated from the migration account and should receive only the privileges it needs.
Operational protection
The application includes login lockout, endpoint rate limits, security headers, audit events, restricted health checks and production configuration through environment variables.
Responsible disclosure
Security concerns can be reported privately to recovery@drivediggers.com. Do not include customer data or credentials in an initial report.