Security
Security
Last reviewed [[EFFECTIVE DATE]]
The thing here genuinely worth stealing is your SAM.gov API key. It is tied to your SAM.gov account, and a stolen one both exposes that account and lets someone burn a daily quota that may be as small as ten requests. Most of what follows exists to protect it.
We do not hold a SOC 2 report or a FedRAMP authorisation, and we are not going to imply otherwise with a badge. Prime Connect is a small, deliberately simple product. What we can offer instead is a specific description of what it does, which you can check.
1. Your SAM.gov API key
The key is read only on the server. Specifically:
- It is never sent to a browser. The settings screen receives a masked
form —
SAM-abcd…7890— plus its age and where it came from. No endpoint returns the key itself. - It is never logged and never appears in an error message. Every message from a data pull is passed through a redaction filter before it is written to a log or stored, because pull errors are shown back to signed-in users.
- It is stored on an encrypted volume, in a database file readable only by the application’s own account.
- You can replace or remove it from the settings screen at any time, with no redeployment and no support ticket.
Prime Connect warns administrators once a key passes 80 of its 90 days, so it is rotated before the daily pull starts failing rather than after.
2. Accounts and sessions
| Control | How |
|---|---|
| Password storage | scrypt, 16-byte random salt per account, parameters recorded per hash so they can be strengthened later without forcing a reset |
| Session handling | Random identifier stored server-side; the cookie carries an HMAC-SHA256 signature checked in constant time |
| Cookie flags | HttpOnly, Secure, SameSite=Lax, 30-day expiry |
| Brute force | 20 attempts per IP address and 10 per email address per 15 minutes |
| Account enumeration | A wrong password and an unknown address return the same message and take the same time — the miss path performs an equivalent hash |
| Authorisation | Authentication is enforced above every data route, so a new endpoint is protected by default rather than by remembering to guard it |
| Startup | The service refuses to start in production without a strong session secret — a weak one would make session cookies forgeable |
3. In the browser
Prime Connect sends a strict Content-Security-Policy. The page loads no third-party script, no external font, no analytics and no advertising code, and it makes network requests to nothing but its own origin — SAM.gov and DLA are called server-side, and USAspending is proxied. That is unusually tight for a web application, and it is possible only because there is nothing else on the page.
Also in place: nosniff, frame-ancestors 'none' so the app cannot
be framed, HSTS, a same-origin referrer policy, and a cross-site request guard on every
state-changing request. Links carried in from government feeds are restricted to
http and https schemes, so a malformed upstream record cannot
become a script link.
4. Dependencies
Five runtime dependencies, with zero known vulnerabilities at the time of writing. We deliberately avoided several popular libraries — for password hashing, security headers, rate limiting and schema migrations — because each was a few dozen lines against the standard library and every one avoided is an audit surface that cannot bite us.
5. What is still your responsibility
- Give people their own accounts. Shared logins defeat the record of who saved what, and removing one person means changing everyone’s password.
- Remove people when they leave. One click in settings.
- Rotate your SAM.gov key if it has ever been in a shared file, an email or a screenshot.
- Remember the workspace is shared. Notes and pricing figures are visible to everyone in it. Do not type anything there you would not say in a team meeting.
- Do not store regulated material. Prime Connect is not accredited for classified information, controlled unclassified information, or export-controlled technical data.
6. Reporting a vulnerability
Write to [[CONTACT EMAIL]] with enough detail to reproduce it. We will acknowledge within three business days and keep you updated until it is resolved.
Good-faith research is welcome, and we will not pursue action against you for it, provided you do not access, modify or delete data belonging to anyone else, do not degrade the service, and give us reasonable time to fix the issue before publishing. We do not currently run a paid bounty.
No system is perfectly secure, and this page describes intent and implementation rather than a guarantee. If we discover a breach affecting your data we will tell affected administrators without undue delay.