This document describes the security measures implemented in PayLink.

1. Overview
2. Authentication
3. Webhook Security
4. Input Validation
5. Cryptographic Operations
6. Secrets Management
7. OWASP Compliance

PayLink implements defense-in-depth security with multiple layers of protection:

All API requests (except /health and /metrics) require authentication via API key:

Header: X-Api-Key: <merchant_api_key>

• API keys are stored as bcrypt hashes in the database
• Original keys are never stored
• Keys are validated using constant-time comparison

Recommended key rotation schedule:

• Production: Every 90 days
• Sandbox: As needed

Each provider uses specific signature verification:

Algorithm: SHA512
Input: order_id + status_code + gross_amount + ServerKey
Location: JSON body field "signature_key"

Implementation:

raw := orderID + statusCode + grossAmount + serverKey
expected := sha512.Sum512([]byte(raw))
valid := constantTimeCompare(hex.EncodeToString(expected[:]), signatureKey)

Algorithm: Token comparison
Location: Header "x-callback-token"

Implementation:

callbackToken := r.Header.Get("x-callback-token")
valid := hmac.Equal([]byte(callbackToken), []byte(configuredToken))

All signature comparisons use constant-time algorithms:

func constantTimeCompare(a, b string) bool {
    if len(a) != len(b) {
        return false
    }
    var result byte
    for i := 0; i < len(a); i++ {
        result |= a[i] ^ b[i]
    }
    return result == 0
}

All incoming requests are validated:

All JSON payloads are validated before parsing:

if !json.Valid(body) {
    return fmt.Errorf("invalid JSON payload")
}

PayLink uses Go's standard library for cryptographic operations:

Used for general signature operations:

func ComputeHMAC(key, data string) string {
    h := hmac.New(sha256.New, []byte(key))
    h.Write([]byte(data))
    return hex.EncodeToString(h.Sum(nil))
}

For high-throughput scenarios (>100k webhook verifications/second), an optional C++ module is available:

• Location: crypto_cpp/
• Build: CMake + OpenSSL
• Integration: CGO wrapper

When to use C++:

• Batch signature verification
• High-frequency webhook processing
• CPU-bound crypto operations

All secrets are loaded from environment variables:

MIDTRANS_SERVER_KEY=your-server-key
XENDIT_API_KEY=your-api-key
STRIPE_SECRET_KEY=sk_test_xxx
STRIPE_WEBHOOK_SECRET=whsec_xxx

• Never commit secrets to git
• Never log secrets
• Never include secrets in error messages
• Never expose secrets in API responses

PayLink follows OWASP security guidelines:

• Parameterized SQL queries via database/sql
• Input validation before use
• No dynamic query construction

• API key required for all sensitive endpoints
• Keys stored as hashes
• Rate limiting recommended

• Secrets never logged
• API keys masked in responses
• HTTPS required in production

• Environment-based configuration
• No default credentials
• Secure defaults

• JSON-only API (no HTML rendering)
• Proper Content-Type headers

• JSON validation before parsing
• Type-safe unmarshaling

• Minimal dependencies
• Regular dependency audit (go mod verify)

• Structured JSON logging
• Request/response logging
• Error tracking
• Metrics endpoint

Before deploying to production:

• All secrets loaded from environment/secret manager
• HTTPS enabled and enforced
• API key authentication active
• Rate limiting configured
• Input validation enabled
• Webhook signatures verified
• Logging configured (secrets masked)
• Monitoring/alerting set up
• Dependency audit completed

If you discover a security vulnerability, please report it via:

• Email: [email protected]
• Do NOT create public GitHub issues for security vulnerabilities

Document maintained by PayLink Security Team