Trust & security
OWASP Top-10 hardened
Before Pro launch, the Horizons backend was reviewed against the full OWASP Top-10 and hardened against every category. Findings drove the security architecture you see in production today. This was our own engineering review — not an independent third-party penetration test.
- Per-route Redis-backed sliding-window rate limiter (auth 5/min, API 60/min, compute 5/min, webhooks 200/min).
- CSRF protection on every mutating request via HMAC tokens tied to the session.
- Strict per-request Content-Security-Policy with nonces; frame-ancestors 'none'.
- Mass-assignment guard: BaseRepository.update has a hardcoded deny-list; per-route allow-lists on profile + scenarios endpoints.
- Plaid webhooks verified via ES256 JWT + SHA-256 body hash.
- Account-lockout with exponential backoff (1 min → 24 h) after 5 failed logins; zxcvbn ≥ 3 password policy with min 12 chars.
Honest note
Being exact about what this is: an internal engineering review against the OWASP Top-10, plus the remediation it drove. It is not a third-party attestation, and we don't present it as one. An independent penetration test is planned alongside SOC 2 Type II and has not happened yet — see /trust/soc2. The review write-up and remediation record are held internally and available under NDA on request via /contact.
More on how we protect your data, in plain terms:
Full security overview