Tightened Security on the Pipe Platform

For some time now we’ve been working closely with a pen tester to tighten the security of the Pipe platform.

The work has been extensive and its ongoing work but briefly, I can say we went through:

• CSRF tokens used in the Pipe account area
• XSS filters on input and possible XSS exploits
• Escaping input data when shown or used
• SQL injection testing
• Spoofing most of the params sent to our account and recording client endpoints
• Brute forcing the sign in/sign up/reset password pages
• Brute forcing other endpoints
• CORS headers for the recording client files
• Website headers (we now get an A @ https://securityheaders.com/)
• Firewall rules protecting our servers
• Whitelist of extensions allowed when uploading existing recordings
• Server-side technology information disclosures