Security and privacy · 005.8
What the code actually does to protect accounts, data and integrations, and where it falls short. Every control here was checked against the source.
The controls
| Area | Control | Status |
|---|---|---|
| Passwords at rest | scrypt with a random salt, constant-time comparison. Koha hashes are verified, then replaced with scrypt on first sign-in. | Built |
| Sessions | Short-lived access tokens held in memory by the web app; rotating refresh tokens stored hashed; reuse of a rotated token ends all sessions. | Built |
| Brute force | Per-account lockout (5 failures, 15 minutes, configurable) and a per-IP rate limit on sign-in routes. | Built (limiter is per process) |
| Two-factor | Optional TOTP, secret encrypted at rest, admin reset. | Built (no recovery codes; cannot be mandated) |
| Authorisation | 29 permissions and 8 staff roles behind a global guard; no privilege escalation; the last super admin is protected. | Built |
| SQL reports | Tokenising guard, read-only transaction, statement timeout and row cap. | Built |
| Webhooks and API | HMAC-SHA256 signed webhooks with timestamps, SSRF checks, auto-disable after repeated failures; scoped API clients. | Built |
| File uploads | MIME allowlist and magic-byte check, no SVG or HTML, random names, nosniff and a sandbox policy on download. | Built |
| Audit | A staff-visible action log with filters and CSV export. | Partial (no tamper protection or retention job) |
| Privacy | Per-member reading-history policy, scheduled anonymisation, member self-service erase, staff anonymise. | Built (consent ledger and data-subject export planned) |
Roles
Super admin, library admin, librarian, circulation clerk, cataloguer, acquisitions, volunteer and guard, each with granular permissions on top. A guard sees one screen; a volunteer sees less than a librarian.
Plainly
Has Lumina had a penetration test or security audit?
No. There has been no independent penetration test or audit. The controls above are engineering controls verified by reading the code and its tests, not a compliance attestation.
Is Lumina DPDP compliant?
Lumina includes privacy tooling that supports compliance work (history policy, anonymisation, erase, an audit log), but compliance is a property of how you run it. Our notes are engineering notes for your counsel to confirm, not legal advice. A consent ledger and data-subject export are planned.
Where is the data stored?
In your Postgres database. Nothing is deployed to a public host by us yet; you choose where it runs.
Next step
Ask us the hard questions.
Bring your security reviewer. We would rather answer in person than gloss over it here.