Skip to content

Eight EAC partner states

About

Security

The measures protecting MyEASOKO, the results of the latest checks and the known risks.

Updated on

Measures in place

  • Encrypted connection (HTTPS) end to end, with HSTS in production, behind Cloudflare in "Full (strict)" mode.
  • Content Security Policy (CSP) with a random token per request for scripts; the platform cannot be embedded in a third party site (frame-ancestors).
  • Protective headers: X-Content-Type-Options, Referrer-Policy, Permissions-Policy (camera, microphone, geolocation disabled), Cross-Origin-Opener-Policy.
  • Hashed passwords (bcrypt), server side sessions, HttpOnly and Secure cookies, CSRF protection on every form.
  • Administration restricted to authorised accounts, with roles (administrator, editor, reviewer, focal point) and an audit trail.
  • Rate limiting on the public API, the contact form and the assistant.
  • API keys stored only as a SHA-256 hash.
  • Audience statistics without cookies or personal data.
  • Daily backup of the database and files, with an automated restore test every day.
  • PHP and JavaScript dependencies checked against known vulnerability databases.

Latest checks

Checks of 22 September 2026

  • composer audit (PHP dependencies): no known vulnerability.
  • npm audit --omit=dev (JavaScript dependencies): no known vulnerability.
  • Automated check of headers and common misconfigurations (.env and .git files not reachable, no directory listing, protected cookies): see the details in the technical documentation.
  • OWASP ZAP baseline scan: to be run on the production server, command provided in the documentation.

Load test

An indicative low load test was run on a development machine. The full test (ramping up to 100 concurrent users) is to be run on the production server before launch, with the k6 scripts provided.

Accepted risks

  • The CSP allows code evaluation ('unsafe-eval') because the Alpine interface library needs it. Scripts remain limited to the site itself and to blocks carrying the request token.
  • Inline styles are allowed ('unsafe-inline' for styles) for the theme colours and some components. This setting does not allow code to run.
  • The administration uses a looser CSP (inline scripts allowed): it is reachable by authorised accounts only.
  • Simulator amounts and some data are indicative: they are flagged as such on every page.

Information :

Report a vulnerability

If you think you have found a flaw, write to us through the contact form with "Security" in the subject. Please do not disclose the issue before it is fixed. Write to the team