> ## Documentation Index
> Fetch the complete documentation index at: https://ihub.learnille.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform Security Policy

> Migrated from the previous Learnille internal documentation hub

## Overview

This policy specifies baseline security controls, password requirements, rate-limiting policies, and secret management guidelines across the Learnille platform.

***

## 🛡 Security Rules & Best Practices

### 1. Password & Authentication Strength

* **Length & Complexity**: Passwords must be a minimum of 8 characters, containing at least 1 uppercase letter, 1 number, and 1 special character.
* **Hashing Standard**: Password hashes generated using Argon2id with recommended memory and iteration parameters.

### 2. Rate Limiting & Abuse Prevention

* **Auth Endpoints** (`/auth/login`, `/auth/forgot-password`, `/withdrawals/request`): Limited to **5 requests per minute per IP** via NestJS `@ThrottlerGuard`.
* **Public Endpoints**: Limited to **100 requests per minute per IP**.

### 3. Secret Management

* **Zero Credentials in Codebase**: API keys, database credentials, JWT secrets, and payment webhooks MUST be loaded exclusively via environment variables (`.env`).
* **Secret Rotation**: Database and payment webhook secrets rotated every 90 days.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.