Digital signage security, explained plainly

Protecting the admin

• CSRF protection on every change made in the admin.
• Content Security Policy with a per-request script nonce, and frame headers so the admin cannot be embedded in another site.
• Session cookies are HTTP-only and not sent on cross-site requests.
• Rate limits on sign-in, screen pairing and device registration, held in the database so they apply across every server process.
• Safe redirects after sign-in, so a crafted link cannot send you to another site.
• Validated layouts. Widget settings from the layout designer are validated and escaped on the server.
• Request size limits on the device API and on JSON bodies.

Media, dashboards and access keys

Many signage screens show internal dashboards. To do that without an interactive login, a web page can carry an access key, as a secret URL parameter or an HTTP header.

• Access keys are masked in the admin and never sent back to the browser after you save them.
• They are sent only to the screens that show that page, never into previews.
• Uploads are checked by content type, and nothing in the uploads area can execute.
• Converted slides, thumbnails and screenshots live at random, unguessable paths.
• Calendar links are fetched by the server, so the private iCal address never reaches a screen.

Outbound requests: feeds and webhooks

RSS tickers and alert webhooks make the server fetch URLs that a customer typed in. That is a classic route for server-side request forgery, so the HTTP client that makes these requests:

• blocks private and internal network addresses,
• pins the DNS answer it checked, so a hostname cannot switch to an internal address between the check and the request,
• checks every redirect hop again, not just the first URL.

Alerts go to email, Microsoft Teams, Slack or a generic webhook. See monitoring and alerts.

Backups, retention and operations

In the production setup the database is backed up every night, and backups are kept for 14 days. Production runs with error display off, log rotation and health checks.

Retention is set by default and kept short where it can be: proof-of-play records are kept for 400 days, the activity log for two years. Unpaired screens that never finish pairing are removed after seven days.

We do not hold security certifications today, and we will not claim ones we do not have. If your review needs something not covered here, ask us on the contact page.

Report a security issue

If you think you have found a vulnerability in CompleteVantage, please tell us through the contact page and mark it as a security report. Include what you found, how to reproduce it and what an attacker could do with it. Please give us a reasonable time to fix it before sharing it publicly, and do not access other customers' data while testing. We will reply, keep you updated and credit you if you want.