Built with Security from Day One

Security at Riven

Learn how Riven protects your forms, responses, and infrastructure through layered security practices.

Version 1.0 • August 2026

Introduction

At Riven, security and data privacy are foundational design principles. Every request, authentication flow, and database operation is designed with layered security controls to help protect customer data.

This post details what technologies we use for security, why we chose them, and how our defense-in-depth architecture safeguards your data against modern web vulnerabilities.

Security Architecture at a Glance

Security Domain	Solution Implemented	Primary Threat Mitigated
Authentication & Sessions	Better Auth + Secure HTTP-Only Cookies	Session Hijacking, Account Takeover, CSRF
API & Schema Validation	tRPC v11 + Zod Schema Validation	Parameter Tampering, Invalid Inputs, XSS Payload Delivery
Data Layer	Drizzle ORM + PostgreSQL Parameterized Queries	SQL Injection (SQLi), Data Corruption
Rate Limiting	Tiered Express Rate Limiters	Brute Force Attacks, Form Spam, DoS / DDoS
Access Control	Context-Aware Middleware (`authenticatedProcedure`)	Unauthorized Access, Privilege Escalation
Origin Protection	Strict CORS Domain Whitelisting	Cross-Origin Data Exfiltration

How Request Security Works (Data Flow)

Every request entering Riven undergoes multiple layers of verification before reaching application logic or the database:

Step 1

Rate Limiting Middleware

Checks request limits per IP to stop brute-force & spam attacks.

Step 2

CORS Origin Lockdown

Verifies request origins against approved domain whitelist.

Step 3

tRPC Router Validation

Validates input structure against strict Zod runtime schemas.

Step 4

Procedure & Session Check

Routes through public or authenticated procedure logic.

Step 5

Business Logic Execution

Executes authorized application services & validation rules.

Step 6

Drizzle ORM & PostgreSQL

Executes parameterized SQL queries safely into PostgreSQL.

Request Verification Architecture

Zero-Trust Request Flow

Client (User / Form Respondent)

HTTPS Encrypted Request

Step 1

Rate Limiting

Per-IP Middleware

Step 2

CORS Validation

Origin Lockdown

Step 3

tRPC + Zod

Schema Check

4. Procedure Check

Public Procedure

(Unauthenticated Form Access / Submission)

5. Execute Business Logic

6. Drizzle ORM (Parameterized SQL)

PostgreSQL Database

Authenticated Procedure

(Form Creator & Dashboard Operations)

Better Auth Session Validation

Valid Session (Yes)

5. Execute Business Logic

6. Drizzle ORM

PostgreSQL

Invalid / Expired (No)

401 Unauthorized Error

Deep Dive: Our Core Security Layers

1. Authentication & Session Management (`Better Auth`)

We use Better Auth, an enterprise-grade authentication framework built specifically for modern TypeScript ecosystems.

Password Security: Passwords are never stored in plain text. Passwords are securely hashed before storage using Better Auth's configured password hashing implementation.
Flexible & Secure Login Methods: Users can authenticate via traditional passwordless/email workflows or linked OAuth 2.0 social providers (Google, GitHub, Discord).
Strict Cookie Flags:
- HttpOnly: Session cookies cannot be accessed by JavaScript, protecting your session from Cross-Site Scripting (XSS) token theft.
- Secure: Cookies are strictly restricted to encrypted https:// transmissions in production environments.
- SameSite=Lax: Helps reduce the risk of Cross-Site Request Forgery (CSRF) attacks when combined with origin validation.
- Cross-Subdomain Scoping: Scoped precisely to .rivenforms.in to prevent unauthorized third-party origin access.
No-Cache Auth Headers: Authentication endpoints set strict cache controls (Cache-Control: no-store, no-cache) so sensitive credentials are never stored in intermediate CDN or browser caches.

2. End-to-End Type Safety & Data Validation (`tRPC` + `Zod`)

Unlike conventional REST APIs where request bodies can contain arbitrary, unvalidated JSON payloads, Riven uses tRPC backed by Zod schema validation.

Runtime Input Sanitization: Every input parameter (form field creation, title edits, submission payloads) must pass a strict Zod contract. Unexpected fields are stripped, and invalid data types are rejected immediately.
Zero Untyped API Boundaries: TypeScript types are shared directly between frontend components and backend services. This guarantees that malformed requests are caught at compile time and rejected at runtime before touching core logic.

3. SQL Injection Protection (`Drizzle ORM` + `PostgreSQL`)

SQL Injection (SQLi) remains one of the most common and impactful web application vulnerabilities. Riven uses Drizzle ORM for database access, which executes standard database operations using parameterized queries instead of string-concatenated SQL.

Parameterized Queries: Drizzle translates database operations into parameterized PostgreSQL queries ($1, $2, ...). User input is treated as data rather than executable SQL, helping prevent SQL injection attacks in standard application queries.
Relational Integrity: Foreign key constraints and cascading deletes (onDelete: "cascade") help maintain data consistency and prevent orphaned records.

4. Abuse Prevention & Multi-Tiered Rate Limiting

To reduce abusive traffic, credential stuffing, and automated spam, Riven applies context-aware rate limiting across its API endpoints.

Authentication Endpoint Limiter: Restricted to 30 requests per minute per IP. Prevents automated brute-force password guessing.
Form Submission Limiter: Restricted to 10 submissions per minute per endpoint. Prevents spam bots from flooding form creators with junk responses.
General API & tRPC Limiter: Cap of 100 requests per minute across standard application routes to ensure overall platform stability and fair usage.

5. Cross-Origin Resource Sharing (CORS) & Network Isolation

Riven enforces a strict origin validation strategy:

Cross-Origin requests are filtered at the application entry point. Only trusted domains (rivenforms.in, www.rivenforms.in, api.rivenforms.in, and approved development origins) are granted access.
Requests originating from untrusted domains are rejected before application logic executes.

6. Granular Access Control & Protected Procedures

Authorization in Riven is enforced declaratively at the API layer:

publicProcedure: Reserved strictly for unauthenticated public actions, such as fetching a public form layout or submitting a response.
authenticatedProcedure: Secures all management operations (creating forms, editing fields, viewing response analytics, deleting records). Every call automatically extracts and verifies the session token using auth.api.getSession(). Unauthenticated or invalid requests return a 401 UNAUTHORIZED response before protected business logic executes.

7. Modular Architecture & Secret Isolation

Riven is engineered as a clean Turborepo monorepo with explicit package boundaries (@repo/auth, @repo/database, @repo/trpc, @repo/email).

Client-Server Secret Separation: Database credentials, OAuth secrets, and API keys reside exclusively in isolated server-side environment configurations (apps/api, .env). They are never bundled into or accessible by client-side browser JavaScript (apps/web).

Threat Matrix & Protection Summary

Threat Vector	Industry Risk	Riven's Mitigation
SQL Injection (SQLi)	High	Drizzle ORM parameterized query generation.
Cross-Site Scripting (XSS)	High	React/Next.js automatic output encoding + `HttpOnly` session cookies.
Cross-Site Request Forgery (CSRF)	Medium	`SameSite=Lax` cookie flags + origin verification.
Credential Stuffing / Brute Force	High	Tiered rate limiting (30 req/min on Auth endpoints).
Form Spam & Bot Flooding	High	Targeted rate limiting (10 submissions/min) + schema validation.
Unauthorized Data Access	Critical	Enforced `authenticatedProcedure` session verification on all private routes.
Man-in-the-Middle (MitM)	Critical	Mandatory HTTPS / TLS encryption in transit + `Secure` cookies.

Frequently Asked Questions (FAQ)

Built with security, speed, and developer experience at heart.