Security
How Your Site Is Protected
jekcms applies layered security: accounts, data, the application, the API and the update chain are each protected in their own right. Every item on this page is a control that actually exists in the product.
Account Security
- Two-factor authentication (TOTP) for admin and customer accounts; one-time codes cannot be replayed, backup codes are supported.
- Passwords are hashed with Argon2id; plain-text passwords are never stored.
- Accounts lock after repeated failed sign-ins; even logout is CSRF-protected.
Data Protection
- API, e-mail and payment provider keys are stored encrypted with AES-256-GCM; settings forms never echo secrets back.
- You self-host: your content and database stay on your own infrastructure.
- CSV exports are sanitized against formula injection.
Application Hardening
- Every public form goes through a single spam/flood-protection surface; request rate limits are built in.
- Uploaded files pass real content validation (image verification, SVG sanitizing).
- Tools that make outbound requests (e.g. the link health checker) are constrained against SSRF.
API Security
- API access is key-based; roles are closed by default (fail-closed) and can be restricted per key.
- Outgoing webhooks are signed with HMAC-SHA256; every delivery is logged.
- Keys can be revoked from the panel with one click.
Update Integrity
- Install packages are verified with sha256 checksums; packages never contain secrets or keys (asserted automatically before release).
- An installed site regularly checks the integrity of its core files; tampering is detected.
- What each release changes is published in the public changelog.
Honest Limits
- No system is absolutely secure or unbreakable; jekcms applies layered protection and does not promise absolute guarantees.
- In a self-hosted product, server configuration and backups are the user's responsibility; the panel guides you through both.
- Security fixes state what was hardened — exploitation details are never published.
Found a Vulnerability?
Good-faith security research is welcome. Send your finding to info@jekcms.com; machine-readable contact details are also published in security.txt. Reports are accepted in English or Turkish. Confirmed findings are fixed and the fix is announced in the changelog.