# Milestone 3 Security Review

### Security Review for Littlefish NFT Auth Framework (NPM Package)

#### Security Measures Implemented in Milestone 3:

1. **Authentication**:
   * **Email/Password Authentication**: Uses bcrypt for hashing passwords, ensuring secure storage.
   * **Cardano Wallet Authentication**: Verifies wallet ownership using cryptographic signatures and public keys with `@cardano-foundation/cardano-verify-datasignature`.
   * **Asset Authentication**: In addition to previous methods, now the package supports NFT and Token authentication.
   * **On-Chain Verification**: Ownership of the assets provided by the wallet is verified by Blockfrost API.
   * **Authentication Policies:** Developers can choose to make their authentication only to allow specific policy IDs. Authentication Policy IDs can be as many as the developer wants.
2. **Data Protection**:
   * **Password Hashing**: Uses bcrypt for hashing passwords.
   * **Nonce Generation**: Generates unique nonces using `crypto.randomBytes` to prevent replay attacks.
   * **Hex-to-Bech32 Conversion**: Safely converts hexadecimal strings to Bech32 format using `bech32` for wallet address validation.
3. **Validation Functions**:
   * **String Validation**: Ensures non-empty strings.
   * **Email Validation**: Uses regex to validate email formats.
   * **Password Validation**: Uses regex to enforce strong password criteria.
   * **Wallet Address Verification**: Verifies wallet addresses by converting hex to Bech32 and checking signatures.
   * **PolicyID Verification**: Gets all the addresses that owns assets of the provided policy ID on-chain
   * **Asset Ownership Verification**: Verifies ownership of assets for cardano wallets.
   *

#### Potential Considerations for Future Hardening:

1. **Regular Security Audits**:
   * Conduct regular security audits and code reviews to identify and fix vulnerabilities promptly.
2. **Dependency Management**:
   * Regularly update dependencies to incorporate the latest security patches and improvements.

#### Our Recomendations for the Use of This Package

* **Secure API Management**: Use environment variables or secure vaults to manage API keys and other sensitive configurations.