Security
Last updated August 2026
ℹ️ Everything on this page describes what's actually implemented in this codebase — not aspirational claims. If you deploy LLM Connect somewhere, verify these are still true after any customization.
Encryption
- In transit: all traffic should run over HTTPS/TLS once SSL is enabled on your domain (required — browsers block camera/microphone access without it).
- At rest: names, emails, phone numbers, bios, message content, and filenames are encrypted in the database using authenticated encryption (XSalsa20-Poly1305), with per-field keys derived from a single operator-held master key. This protects against a stolen database backup or an injection bug leaking readable data — it does not protect data from LLM Connect's own server or admins. See our Privacy Policy for the full explanation of what this is and isn't.
- Passwords: hashed with PHP's
password_hash() (bcrypt) — never stored, logged, or recoverable in plaintext.
- Video/audio: WebRTC calls are encrypted browser-to-browser (SRTP/DTLS) and, in our mesh topology, generally don't route through our servers at all.
Account protection
- Login is rate-limited: repeated failed attempts temporarily lock the account.
- Sessions are regenerated on login (defends against session-fixation attacks).
- Session cookies are
HttpOnly, SameSite=Lax, and Secure once SSL is enabled.
- You can view and revoke individual active sessions from Settings → Security.
- Changing your password signs out every other device automatically.
Application security
- All database queries use parameterized prepared statements (PDO) — no raw string concatenation into SQL.
- Every state-changing request requires a CSRF token tied to your session.
- File uploads are checked against both an extension allow-list and a real MIME-type sniff (not just the filename), and the uploads directory is configured to never execute scripts, even if a malicious file slipped past validation.
- Output is escaped before rendering to prevent cross-site scripting.
- Sensitive directories (
config/, includes/) are denied direct web access.
Monitoring
Access to personal data — logins, admin actions on user accounts and reports, data exports, deletion
requests — is recorded in an audit log retained for a minimum of one year.
Reporting a vulnerability
Found a security issue? Please report it responsibly via our Contact page
rather than disclosing it publicly, and give us a reasonable chance to fix it before any disclosure.
[Placeholder — add a dedicated security contact address and, if you want one, a bug bounty policy.]
