All HTTP and WebSocket connections enforce TLS 1.3 with Perfect Forward Secrecy (PFS), preventing packet eavesdropping and man-in-the-middle exploits.
Passwords are never stored in plaintext. We enforce salted Argon2/Bcrypt key derivation with high memory cost parameters, rendering offline brute-force attacks computationally infeasible.
Inspect every authenticated browser or mobile session with IP and timestamp metadata. Remotely terminate unrecognized logins with a single tap from Account Settings.
01. Defense-in-Depth Mechanisms
Raw camera photos carry embedded GPS coordinates, camera serial numbers, and home timestamps. Our ingestion workers automatically scrub this metadata before images are saved to disk, preserving physical privacy.
Distributed Redis token buckets throttle suspicious velocity bursts: authentication attempts, password resets, follower queries, and message broadcasts are capped to halt credential stuffing.
Real-time direct messaging packets are relayed across memory-only WebSocket workers. Once delivered to the recipient device, ephemeral packet payloads are dropped from operational server RAM.
Every backend query executes via parameterized PDO/prepared statements. User input never concatenates directly into raw SQL strings, completely neutralizing SQL injection vectors.
02. Responsible Vulnerability Disclosure Program
AXIONIK values the contributions of ethical security researchers across India and worldwide. If you discover a vulnerability in FriendsBook or AXIONIK infrastructure, please report it responsibly:
PGP Key: Available upon inquiry or at
/.well-known/security.txtSafe Harbor Policy: AXIONIK will not pursue legal action against researchers who discover and report vulnerabilities in good faith without exfiltrating user data or disrupting live production services.