A summary of the security controls QAForgeHub actually implements today. For the full technical detail, see the project's docs/SECURITY.md.
Passwords are hashed with Argon2id and never stored or logged in plain text. Optional TOTP two-factor authentication is available to every user, with one-time recovery codes; organizations can require it for owner/administrator roles. Sessions are randomly generated, stored server-side as a hash, rotated on login and on password reset/change, and can be reviewed and revoked individually from Account settings.
Every organization's data is isolated from every other organization's at the database-query level, not just in the interface. Planning Poker votes stay hidden from everyone, including the facilitator, until a round is revealed.
HTTPS in production, a Content-Security-Policy restricting script execution to the application's own code, clickjacking protection, and standard hardening headers.
Login, registration, password reset, and other sensitive actions are rate-limited. Registration during the private beta requires a valid invitation.
Email support@qaforgehub.com with "Security Report" in the subject line, and enough detail to reproduce the issue: affected route/feature, steps, and impact. Don't include real user data, credentials, or session tokens in your report, and please don't disclose vulnerabilities publicly before they've been addressed. See the repository's SECURITY.md for the full policy, including scope and what to expect.
QAForgeHub does not claim formal compliance with any specific legal or security certification framework (e.g. SOC 2, ISO 27001, HIPAA, PCI DSS). It is a private beta undergoing active security hardening, not a certified or independently audited platform.