If you discover a security vulnerability in DubRelay, please report it responsibly.
DO NOT open a public GitHub issue for security vulnerabilities.
Instead, please email: support@dubrelay.com
Include the following in your report:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
We will acknowledge receipt within 48 hours and provide a timeline for a fix.
DubRelay implements the following security measures:
- Authentication: JWT-based authentication with bcrypt password hashing
- Authorization: Role-based access control (user, support_admin, super_admin)
- Data Protection: API keys are encrypted at rest; sensitive data is masked in the UI
- Rate Limiting: Login attempts are rate-limited to prevent brute force attacks
- HTTPS: All traffic is encrypted via TLS/SSL
- Audit Logging: Administrative actions are logged for audit trails
- User email addresses are masked in the UI (e.g., te***@test.com)
- API keys display only the last 4 characters (e.g., ••••3b59)
- Voice clone samples are stored securely and associated with user accounts
- No user data is shared with third parties without consent
We appreciate responsible disclosure and will credit security researchers who help us improve DubRelay's security (upon request).