BLACKMAFIA // SECURITY
SECURITY
BY DESIGN.
BlackMafia uses focused security controls, temporary data handling and separated service architecture to reduce unnecessary exposure.
Security is an ongoing process. No software can guarantee absolute security.
SECURITY LAYERS.
TEMPORARY DATA
ShadowChat rooms and messages are designed around temporary lifecycles and automatic room expiration, minimizing data longevity.
CONTROLLED ACCESS
The administrative control center is protected through authenticated admin sessions, signed HTTP-only cookies, and bounded route access.
RATE LIMITING
ShadowChat enforces strict throttle thresholds against excessive room joins, connection hammering, and high-frequency message flooding.
SEPARATED SERVICES
BlackMafia deploys discrete service boundaries between the Next.js web application, the ShadowChat Socket.IO server, and the StegaX Flask backend.
HOW THE PLATFORM IS STRUCTURED.
COMPONENT CONTROLS.
ShadowChat Security
Designed around ephemeral room lifecycles. Note: ShadowChat uses transport-layer encryption (HTTPS/WSS) and does not provide end-to-end client encryption.
- Server-authoritative room codes (verified on connection)
- Strict room membership and active presence handling
- Join rate limiting to prevent automated brute-force scans
- Message flood control with client throttling
- Room expiration and automated cleanup routines
- Temporary PostgreSQL persistence with bounded backlogs
- Manual "Erase Chat History" purge capability
- Bounded message queue buffers to avoid resource exhaustion
StegaX Security
Operates by embedding data within visual carrier images. Steganography conceals the presence of data, while password options protect extraction workflows.
- Password-protected payload embedding and decoding
- Least Significant Bit (LSB) image-based steganography
- Client-side preview with secure extraction workflow
- Dedicated Flask backend for heavy steganographic computations
- No persistent file storage required for payload encoding
Admin Security
The management console enforces authenticated administrative workflows with protected session state and token validation on all administrative endpoints.
- Authenticated administrative access gateway
- Cryptographically signed admin session cookies
- HTTP-only flags preventing JavaScript cookie access
- Automated session lifetime and timeout expiration
- Protected server-side and middleware route verification
SECURITY IS A PROCESS.
BlackMafia is designed with security controls at multiple layers, but security is never a finished feature. The platform should continue to be tested, reviewed and improved as it evolves.
We believe in technical transparency over sensationalism: defining precise service boundaries, avoiding false claims, and empowering users with practical privacy tools.