Security at BeyondMed

• Passwords are hashed with bcrypt (never stored in plain text).
• Sessions use an httpOnly, Secure, SameSite cookie (not readable by scripts).
• Signing out invalidates the session server-side.
• Login and registration are rate-limited to slow brute-force attempts.
• Roles and account status are checked on the server for every protected request.

• HTTPS / TLS for traffic to beyondmed.in.
• Database access via authenticated MongoDB Atlas connections.
• Secrets (database URI, signing keys) live in server environment variables — not in the browser.
• API error messages avoid stack traces and secret leakage to clients.
• You can delete your account and associated personal data from the mentee profile (or by email).

• Security headers (including HSTS, frame denial, content-type nosniff).
• CORS restricted to BeyondMed front-end origins.
• Ownership checks so one mentee cannot access another mentee’s resources by changing IDs.
• Production seed/demo wipe scripts are blocked.
• Open public registration can be disabled in production configuration.

• Use a unique, strong password.
• Sign out on shared devices.
• Do not share mentor or mentee portal screenshots that contain other people’s data.
• Report suspected vulnerabilities to security@beyondmed.in (please include steps to reproduce; do not exfiltrate user data).

We welcome good-faith reports. We will acknowledge valid reports and work to remediate. Please give us a reasonable time to fix issues before public disclosure. Do not perform destructive testing, social engineering of staff, or attacks against other customers.

• Privacy Policy
• Cookie Notice
• Terms of Use