Security
We take the security of your account and data seriously. Here's a straightforward overview of how we protect you.
Account security
Password hashing
Passwords are never stored in plain text. We use bcrypt with a high work factor to hash all passwords before storage.
JSON Web Tokens
Authentication is handled via short-lived signed JWTs. Tokens are verified on every request and cannot be tampered with.
Google OAuth
Sign-in via Google uses the official OAuth 2.0 flow. We never see or store your Google password.
Rate-limited login
Repeated failed login attempts trigger automatic rate limiting and temporary IP blocks to prevent brute-force attacks.
Data in transit
HTTPS everywhere
All traffic between your browser and CahooTravel is encrypted using TLS. We enforce HTTPS and reject plain HTTP connections.
Secure headers
We set strict security headers on every response — including HSTS, X-Frame-Options, X-Content-Type-Options, and CSP — to protect against common web attacks.
CORS policy
Cross-origin requests are restricted to our own domains. Third-party sites cannot make authenticated requests on your behalf.
Data storage
Minimal data collection
We only store what is necessary: your email address, hashed password, and search history. We do not store payment card details — billing is handled by a PCI-compliant processor.
No selling of data
We do not sell, rent, or share your personal data with third parties for marketing purposes. Period.
Session isolation
Each proxy session runs in an isolated browser context. Cookies, localStorage, and session data from one user are never accessible to another.
Infrastructure
DDoS protection
Our infrastructure includes server-side rate limiting and IP-level throttling to absorb and mitigate denial-of-service traffic.
Dependency hygiene
We audit third-party dependencies regularly and apply security patches promptly. Our stack is kept up to date.
Monitoring & alerting
Automated monitoring watches for unusual traffic patterns, error spikes, and authentication anomalies. We are alerted immediately if something looks wrong.
Found a vulnerability?
We welcome responsible disclosure. If you've found a security issue, please contact us privately before making it public. We'll investigate promptly, keep you informed, and credit you for the find if you'd like.
Report a vulnerability →Last reviewed: April 2026. For data handling details, see our Privacy policy.