Skip to content
DubPlanner

Security & Architecture

Overview

Section titled “Overview”

DubPlanner is designed with security as a top priority. This page provides an overview of the application’s architecture, authentication mechanisms, and the protections in place to keep your data secure.

System Architecture

Section titled “System Architecture”

Hosting Infrastructure

Section titled “Hosting Infrastructure”

DubPlanner is hosted on Google Cloud Platform (GCP) with the following components:

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   Firebase      │    │   Cloud Run     │    │   GCP           │
│   Hosting       │◄──►│   (Backend API) │◄──►│   Services      │
│   (Frontend)    │    │                 │    │                 │
│ • CDN           │    │ • Auto-scaling  │    │ • Firestore     │
│ • SSL/TLS       │    │ • Load balanced │    │ • Secret Mgr    │
│ • Global Edge   │    │ • Health checks │    │ • Monitoring    │
└─────────────────┘    └─────────────────┘    └─────────────────┘

Frontend

Section titled “Frontend”
  • Firebase Hosting: Static Next.js application served via global CDN
  • TLS/SSL Encryption: All traffic is encrypted in transit using HTTPS
  • Edge Network: Content delivered from edge locations closest to users
  • Static Assets: Optimized and cached for fast load times

Backend API

Section titled “Backend API”
  • Google Cloud Run: Containerized ASP.NET Core API with automatic scaling
  • Load Balancing: Automatic traffic distribution across instances
  • Health Monitoring: Continuous health checks ensure availability
  • Zero-downtime Deployments: Rolling updates with no service interruption

Data Storage

Section titled “Data Storage”
  • Google Cloud Firestore: NoSQL document database for application data
  • Encryption at Rest: All data encrypted when stored
  • Encryption in Transit: TLS encryption for all database connections
  • Automatic Backups: Regular automated backups for disaster recovery

Authentication

Section titled “Authentication”

OAuth 2.0 with Linear

Section titled “OAuth 2.0 with Linear”

DubPlanner uses the industry-standard OAuth 2.0 protocol for authentication, currently integrated with Linear. This means:

  • You never share your Linear password with DubPlanner
  • DubPlanner requests only the necessary permissions
  • You can revoke access at any time from your Linear account settings

How Authentication Works

Section titled “How Authentication Works”

  1. Login Initiation:

    • User clicks “Login with Linear” in DubPlanner
    • User is redirected to Linear’s authorization page

  2. Authorization:

    • User reviews requested permissions
    • User grants or denies access to DubPlanner
    • Linear generates a secure authorization code

  3. Token Exchange:

    • DubPlanner exchanges the authorization code for an access token (server-side)
    • The access token is securely stored encrypted in Firestore
    • DubPlanner never sees or stores your Linear password

  4. Authenticated Requests:

    • DubPlanner uses the access token to make API requests to Linear on your behalf
    • All requests are made server-side to protect the token

  5. Session Management:

    • A secure JWT (JSON Web Token) is issued to your browser
    • The JWT expires after a period of inactivity
    • Automatic token refresh keeps you logged in seamlessly

Token Security

Section titled “Token Security”

Access Token Protection

Section titled “Access Token Protection”

How tokens are secured:

  1. Encrypted Storage:

    • Linear access tokens are encrypted using industry-standard encryption
    • Tokens are stored in Google Cloud Firestore with encryption at rest
    • Only the backend API can decrypt and use these tokens

  2. Server-Side Operations:

    • All Linear API requests are made from the backend server
    • Tokens are never sent to the browser or client application
    • This prevents token theft through browser-based attacks

  3. Secure Transmission:

    • All API calls between frontend and backend use HTTPS/TLS
    • End-to-end encryption protects data in transit
    • Certificate pinning prevents man-in-the-middle attacks

  4. Automatic Expiration:

    • Tokens have limited lifetimes and expire automatically
    • Refresh tokens enable seamless re-authentication
    • Expired tokens are immediately invalidated

JWT Session Tokens

Section titled “JWT Session Tokens”

Browser session security:

  • HTTPOnly Cookies: Session tokens can be stored in HTTPOnly cookies (not accessible to JavaScript)
  • Secure Flag: Cookies only transmitted over HTTPS connections
  • SameSite Protection: Prevents cross-site request forgery (CSRF) attacks
  • Short Expiration: Tokens expire after inactivity to limit exposure
  • Automatic Refresh: Seamless token renewal without disrupting workflow

Permissions & Authorization

Section titled “Permissions & Authorization”

User Permissions

Section titled “User Permissions”

DubPlanner respects Linear permissions:

  • You can only perform actions in Linear that your Linear account is authorized to perform
  • If you don’t have permission to edit an issue in Linear, you can’t edit it in DubPlanner
  • Team membership and project access are enforced by Linear’s permission model
  • All actions are performed as your authenticated Linear user

What this means:

  • An admin user can modify all issues and projects
  • A team member can only modify issues assigned to their teams
  • Read-only users can view but not modify issues
  • Permissions are checked on every operation

Customer Data Isolation

Section titled “Customer Data Isolation”

DubPlanner implements strict customer validation:

  • All API requests validate customer ownership
  • Users can only access projects and data belonging to their organization
  • Cross-customer data access is prevented at the API level
  • 403 Forbidden responses enforce authorization boundaries

Data Privacy

Section titled “Data Privacy”

What Data is Stored

Section titled “What Data is Stored”

DubPlanner stores minimal data necessary for functionality:

  • User Profile: Name, email, avatar (from Linear)
  • Authentication Tokens: Encrypted access and refresh tokens
  • Project Preferences: User settings, view preferences
  • Planning Data: Week assignments, availability schedules
  • Session Data: Active sessions for real-time collaboration

What Data is NOT Stored

Section titled “What Data is NOT Stored”
  • Passwords: Never stored (OAuth authentication only)
  • Credit Card Information: No payment processing
  • Personal Documents: No file uploads or document storage
  • Communication Logs: No tracking of messages or emails

Data Retention

Section titled “Data Retention”
  • Active Data: Retained while your account is active
  • Session Data: Cleared automatically after expiration
  • Deleted Data: Permanently removed upon request
  • Backup Retention: 30 days for disaster recovery

Network Security

Section titled “Network Security”

Transport Layer Security (TLS)

Section titled “Transport Layer Security (TLS)”

All network communication is encrypted:

  • TLS 1.2+: Modern encryption protocols only
  • Strong Cipher Suites: Industry-standard encryption algorithms
  • Certificate Validation: Automatic certificate renewal and validation
  • HSTS Enabled: HTTP Strict Transport Security forces HTTPS

CORS Protection

Section titled “CORS Protection”

Cross-Origin Resource Sharing (CORS) is strictly configured:

  • Only approved frontend domains can access the API
  • Prevents unauthorized websites from accessing your data
  • Configured per environment (dev/staging/production)

API Security

Section titled “API Security”
  • Rate Limiting: Prevents abuse and DDoS attacks
  • Input Validation: All inputs sanitized and validated
  • SQL Injection Prevention: Parameterized queries (Firestore NoSQL)
  • XSS Protection: Content Security Policy headers

Infrastructure Security

Section titled “Infrastructure Security”

Google Cloud Platform

Section titled “Google Cloud Platform”

DubPlanner benefits from GCP’s enterprise-grade security:

  • DDoS Protection: Automatic mitigation of distributed attacks
  • Firewall Rules: Network-level access controls
  • IAM Policies: Principle of least privilege for service accounts
  • Secret Manager: Encrypted storage for credentials and keys
  • Audit Logging: Complete audit trail of infrastructure changes

Container Security

Section titled “Container Security”
  • Minimal Base Images: Reduced attack surface
  • Vulnerability Scanning: Automatic image scanning for CVE vulnerabilities
  • Immutable Infrastructure: Containers are rebuilt, not patched
  • No Secrets in Images: Secrets injected at runtime via environment variables

Monitoring & Incident Response

Section titled “Monitoring & Incident Response”

Security Monitoring

Section titled “Security Monitoring”
  • Application Logging: Comprehensive logs of all operations
  • Error Tracking: Automatic alerting for security-related errors
  • Health Checks: Continuous monitoring of service availability
  • Anomaly Detection: Unusual patterns trigger investigation

Incident Response

Section titled “Incident Response”

In the event of a security incident:

  1. Detection: Automated monitoring and alerts
  2. Containment: Immediate isolation of affected systems
  3. Investigation: Root cause analysis
  4. Remediation: Fix vulnerabilities and deploy patches
  5. Communication: Transparent notification to affected users
  6. Post-Mortem: Document lessons learned and improve processes

Compliance & Best Practices

Section titled “Compliance & Best Practices”

Security Standards

Section titled “Security Standards”

DubPlanner follows industry best practices:

  • OWASP Top 10: Protection against common web vulnerabilities
  • OAuth 2.0 Best Practices: Secure authentication implementation
  • Secure Development Lifecycle: Security considered at every stage
  • Regular Updates: Dependencies kept up-to-date for security patches

Third-Party Integrations

Section titled “Third-Party Integrations”

All third-party integrations are carefully vetted:

  • Linear API: Official API with strict rate limits and permissions
  • Google Cloud Services: Enterprise-grade security and compliance
  • Firebase: Google-managed authentication and hosting
  • NPM Packages: Regular audits for vulnerabilities

Revoking Access

Section titled “Revoking Access”

From Linear

Section titled “From Linear”

You can revoke DubPlanner’s access at any time:

  1. Log into your Linear account
  2. Go to Settings → Account → Authorized Applications
  3. Find DubPlanner in the list
  4. Click Revoke Access

Once revoked:

  • DubPlanner can no longer access your Linear data
  • Your stored tokens are immediately invalidated
  • You’ll need to re-authenticate to use DubPlanner again

From DubPlanner

Section titled “From DubPlanner”

You can also disconnect from DubPlanner:

  1. Open DubPlanner
  2. Go to Settings
  3. Click Disconnect from Linear
  4. Confirm the disconnection

This removes the stored token from DubPlanner’s database.

Security Questions?

Section titled “Security Questions?”

If you have security concerns or questions:

  • Security issues and vulnerabilities: report them privately to support@dubplanner.com rather than in a public channel
  • Responsible disclosure is appreciated, and we will acknowledge your report

Summary

Section titled “Summary”

DubPlanner is built with security in mind:

  • ✅ OAuth 2.0 Authentication: Secure, password-free login
  • ✅ Encrypted Storage: Tokens encrypted at rest
  • ✅ Server-Side Security: Tokens never exposed to browser
  • ✅ Permission Enforcement: Respects Linear access controls
  • ✅ GCP Infrastructure: Enterprise-grade hosting and monitoring
  • ✅ HTTPS/TLS: All traffic encrypted in transit
  • ✅ Regular Updates: Dependencies and infrastructure kept current
  • ✅ Audit Logging: Complete visibility into system operations

Your data and credentials are protected at every layer of the application.